# Flog Txt Version 1
# Analyzer Version: 4.5.0
# Analyzer Build Date: Apr 22 2022 21:04:16
# Log Creation Date: 04.05.2022 15:48:31.095
Process:
id = "1"
image_name = "7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe"
filename = "c:\\users\\rdhj0cnfevzx\\desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe"
page_root = "0x73ed6000"
os_pid = "0x6d8"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "analysis_target"
parent_id = "0"
os_parent_pid = "0x748"
cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe\" "
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f600" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 121
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 122
start_va = 0x30000
end_va = 0x31fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 123
start_va = 0x40000
end_va = 0x54fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 124
start_va = 0x60000
end_va = 0x9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000060000"
filename = ""
Region:
id = 125
start_va = 0xa0000
end_va = 0x19ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000a0000"
filename = ""
Region:
id = 126
start_va = 0x1a0000
end_va = 0x1a3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001a0000"
filename = ""
Region:
id = 127
start_va = 0x1b0000
end_va = 0x1b0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001b0000"
filename = ""
Region:
id = 128
start_va = 0x1c0000
end_va = 0x1c1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 129
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 130
start_va = 0x400000
end_va = 0x489fff
monitored = 1
entry_point = 0x48405a
region_type = mapped_file
name = "7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe"
filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe")
Region:
id = 131
start_va = 0x77460000
end_va = 0x775dafff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 132
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 133
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 134
start_va = 0x7fff0000
end_va = 0x7ff884cbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 135
start_va = 0x7ff884cc0000
end_va = 0x7ff884e80fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 136
start_va = 0x7ff884e81000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ff884e81000"
filename = ""
Region:
id = 275
start_va = 0x630000
end_va = 0x63ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000630000"
filename = ""
Region:
id = 276
start_va = 0x5f960000
end_va = 0x5f9affff
monitored = 0
entry_point = 0x5f978180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 277
start_va = 0x5f9b0000
end_va = 0x5fa29fff
monitored = 0
entry_point = 0x5f9c3290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 278
start_va = 0x76410000
end_va = 0x764effff
monitored = 0
entry_point = 0x76423980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 279
start_va = 0x5fa30000
end_va = 0x5fa37fff
monitored = 0
entry_point = 0x5fa317c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 280
start_va = 0x490000
end_va = 0x58ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000490000"
filename = ""
Region:
id = 281
start_va = 0x6e740000
end_va = 0x6e798fff
monitored = 1
entry_point = 0x6e750780
region_type = mapped_file
name = "mscoree.dll"
filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll")
Region:
id = 282
start_va = 0x76410000
end_va = 0x764effff
monitored = 0
entry_point = 0x76423980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 283
start_va = 0x77270000
end_va = 0x773edfff
monitored = 0
entry_point = 0x77321b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 284
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 285
start_va = 0x7feb0000
end_va = 0x7ffaffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007feb0000"
filename = ""
Region:
id = 286
start_va = 0x590000
end_va = 0x5effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000590000"
filename = ""
Region:
id = 287
start_va = 0x640000
end_va = 0x6fdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 288
start_va = 0x740e0000
end_va = 0x74171fff
monitored = 0
entry_point = 0x74120380
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\SysWOW64\\apphelp.dll" (normalized: "c:\\windows\\syswow64\\apphelp.dll")
Region:
id = 289
start_va = 0x7fb00000
end_va = 0x7fea0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb")
Region:
id = 290
start_va = 0x20000
end_va = 0x23fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 291
start_va = 0x76b70000
end_va = 0x76beafff
monitored = 0
entry_point = 0x76b8e970
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 292
start_va = 0x76570000
end_va = 0x7662dfff
monitored = 0
entry_point = 0x765a5630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 293
start_va = 0x590000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000590000"
filename = ""
Region:
id = 294
start_va = 0x5e0000
end_va = 0x5effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005e0000"
filename = ""
Region:
id = 295
start_va = 0x700000
end_va = 0x7fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000700000"
filename = ""
Region:
id = 296
start_va = 0x758e0000
end_va = 0x75923fff
monitored = 0
entry_point = 0x758f9d80
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 297
start_va = 0x76630000
end_va = 0x766dcfff
monitored = 0
entry_point = 0x76644f00
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 298
start_va = 0x74190000
end_va = 0x741adfff
monitored = 0
entry_point = 0x7419b640
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 299
start_va = 0x74180000
end_va = 0x74189fff
monitored = 0
entry_point = 0x74182a00
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 300
start_va = 0x75880000
end_va = 0x758d7fff
monitored = 0
entry_point = 0x758c25c0
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")
Region:
id = 303
start_va = 0x800000
end_va = 0x8bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000800000"
filename = ""
Region:
id = 304
start_va = 0x6c6a0000
end_va = 0x6c718fff
monitored = 1
entry_point = 0x6c6af82a
region_type = mapped_file
name = "mscoreei.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")
Region:
id = 305
start_va = 0x76ed0000
end_va = 0x76f14fff
monitored = 0
entry_point = 0x76eede90
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 306
start_va = 0x769b0000
end_va = 0x76b6cfff
monitored = 0
entry_point = 0x76a92a10
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")
Region:
id = 307
start_va = 0x76d80000
end_va = 0x76ecefff
monitored = 0
entry_point = 0x76e36820
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 308
start_va = 0x755e0000
end_va = 0x75726fff
monitored = 0
entry_point = 0x755f1cf0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 309
start_va = 0x1d0000
end_va = 0x1f9fff
monitored = 0
entry_point = 0x1d5680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 310
start_va = 0x8c0000
end_va = 0xa47fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000008c0000"
filename = ""
Region:
id = 311
start_va = 0x764f0000
end_va = 0x7651afff
monitored = 0
entry_point = 0x764f5680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 312
start_va = 0x30000
end_va = 0x30fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 313
start_va = 0x1d0000
end_va = 0x1d0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001d0000"
filename = ""
Region:
id = 314
start_va = 0x800000
end_va = 0x882fff
monitored = 1
entry_point = 0x88405a
region_type = mapped_file
name = "7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe"
filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe")
Region:
id = 315
start_va = 0x8b0000
end_va = 0x8bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008b0000"
filename = ""
Region:
id = 316
start_va = 0xa50000
end_va = 0xbd0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000a50000"
filename = ""
Region:
id = 317
start_va = 0xbe0000
end_va = 0x1fdffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000be0000"
filename = ""
Region:
id = 318
start_va = 0x755d0000
end_va = 0x755dbfff
monitored = 0
entry_point = 0x755d3930
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")
Region:
id = 319
start_va = 0x71780000
end_va = 0x71787fff
monitored = 0
entry_point = 0x717817b0
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")
Region:
id = 320
start_va = 0x6bfe0000
end_va = 0x6c690fff
monitored = 1
entry_point = 0x6bff5d20
region_type = mapped_file
name = "clr.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")
Region:
id = 321
start_va = 0x71680000
end_va = 0x71774fff
monitored = 0
entry_point = 0x716d4160
region_type = mapped_file
name = "msvcr120_clr0400.dll"
filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll")
Region:
id = 322
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001e0000"
filename = ""
Region:
id = 323
start_va = 0x1f0000
end_va = 0x1fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001f0000"
filename = ""
Region:
id = 324
start_va = 0x5d0000
end_va = 0x5dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005d0000"
filename = ""
Region:
id = 325
start_va = 0x5f0000
end_va = 0x5fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005f0000"
filename = ""
Region:
id = 326
start_va = 0x600000
end_va = 0x60ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000600000"
filename = ""
Region:
id = 327
start_va = 0x610000
end_va = 0x61ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000610000"
filename = ""
Region:
id = 328
start_va = 0x620000
end_va = 0x62ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000620000"
filename = ""
Region:
id = 329
start_va = 0x800000
end_va = 0x800fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000800000"
filename = ""
Region:
id = 330
start_va = 0x810000
end_va = 0x810fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000810000"
filename = ""
Region:
id = 331
start_va = 0x1fe0000
end_va = 0x213ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001fe0000"
filename = ""
Region:
id = 332
start_va = 0x2140000
end_va = 0x233ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002140000"
filename = ""
Region:
id = 333
start_va = 0x820000
end_va = 0x85ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000820000"
filename = ""
Region:
id = 334
start_va = 0x1fe0000
end_va = 0x20dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001fe0000"
filename = ""
Region:
id = 335
start_va = 0x2130000
end_va = 0x213ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002130000"
filename = ""
Region:
id = 336
start_va = 0x860000
end_va = 0x86ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000860000"
filename = ""
Region:
id = 337
start_va = 0x2340000
end_va = 0x433ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002340000"
filename = ""
Region:
id = 338
start_va = 0x2140000
end_va = 0x21dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002140000"
filename = ""
Region:
id = 339
start_va = 0x2330000
end_va = 0x233ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002330000"
filename = ""
Region:
id = 340
start_va = 0x860000
end_va = 0x89ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000860000"
filename = ""
Region:
id = 341
start_va = 0x21e0000
end_va = 0x22dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000021e0000"
filename = ""
Region:
id = 342
start_va = 0x4340000
end_va = 0x4676fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 343
start_va = 0x6adb0000
end_va = 0x6bfd7fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "mscorlib.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll")
Region:
id = 344
start_va = 0x767c0000
end_va = 0x768aafff
monitored = 0
entry_point = 0x767fd650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 345
start_va = 0x4680000
end_va = 0x4710fff
monitored = 0
entry_point = 0x46b8cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 346
start_va = 0x70240000
end_va = 0x702b4fff
monitored = 0
entry_point = 0x70279a60
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")
Region:
id = 347
start_va = 0x4680000
end_va = 0x471ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004680000"
filename = ""
Region:
id = 348
start_va = 0x8a0000
end_va = 0x8affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008a0000"
filename = ""
Region:
id = 349
start_va = 0x71600000
end_va = 0x7167dfff
monitored = 1
entry_point = 0x71601140
region_type = mapped_file
name = "clrjit.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")
Region:
id = 350
start_va = 0x76bf0000
end_va = 0x76c81fff
monitored = 0
entry_point = 0x76c28cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 351
start_va = 0x20e0000
end_va = 0x20effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020e0000"
filename = ""
Region:
id = 352
start_va = 0x6a400000
end_va = 0x6adabfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\cc4e5d110dd318e8b7d61a9ed184ab74\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\cc4e5d110dd318e8b7d61a9ed184ab74\\system.ni.dll")
Region:
id = 353
start_va = 0x6a270000
end_va = 0x6a3fcfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.drawing.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\system.drawing.ni.dll")
Region:
id = 354
start_va = 0x69610000
end_va = 0x6a268fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.windows.forms.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8cd2187094ba6cade0ca0fab4f932654\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\8cd2187094ba6cade0ca0fab4f932654\\system.windows.forms.ni.dll")
Region:
id = 355
start_va = 0x20f0000
end_va = 0x20f0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000020f0000"
filename = ""
Region:
id = 356
start_va = 0x20f0000
end_va = 0x20f1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000020f0000"
filename = ""
Region:
id = 357
start_va = 0x5e430000
end_va = 0x5e4cbfff
monitored = 1
entry_point = 0x5e4be9b2
region_type = mapped_file
name = "microsoft.visualbasic.dll"
filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll")
Region:
id = 358
start_va = 0x2100000
end_va = 0x210ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002100000"
filename = ""
Region:
id = 359
start_va = 0x4720000
end_va = 0x47bbfff
monitored = 1
entry_point = 0x47ae9b2
region_type = mapped_file
name = "microsoft.visualbasic.dll"
filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll")
Region:
id = 360
start_va = 0x4680000
end_va = 0x470efff
monitored = 0
entry_point = 0x468dd60
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll")
Region:
id = 361
start_va = 0x4710000
end_va = 0x471ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004710000"
filename = ""
Region:
id = 362
start_va = 0x69570000
end_va = 0x69601fff
monitored = 0
entry_point = 0x6957dd60
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.10586.0_none_811bc0006c44242b\\comctl32.dll")
Region:
id = 363
start_va = 0x47c0000
end_va = 0x48affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047c0000"
filename = ""
Region:
id = 364
start_va = 0x2110000
end_va = 0x2110fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002110000"
filename = ""
Region:
id = 365
start_va = 0x47c0000
end_va = 0x487bfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000047c0000"
filename = ""
Region:
id = 366
start_va = 0x48a0000
end_va = 0x48affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000048a0000"
filename = ""
Region:
id = 367
start_va = 0x2110000
end_va = 0x2113fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002110000"
filename = ""
Region:
id = 368
start_va = 0x2120000
end_va = 0x2123fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002120000"
filename = ""
Region:
id = 369
start_va = 0x48b0000
end_va = 0x4abafff
monitored = 0
entry_point = 0x495b0a0
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll")
Region:
id = 370
start_va = 0x6e840000
end_va = 0x6ea4efff
monitored = 0
entry_point = 0x6e8eb0a0
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_d3c2e4e965da4528\\comctl32.dll")
Region:
id = 371
start_va = 0x22e0000
end_va = 0x22e0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "windowsshell.manifest"
filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")
Region:
id = 372
start_va = 0x22f0000
end_va = 0x22f1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000022f0000"
filename = ""
Region:
id = 373
start_va = 0x48b0000
end_va = 0x49affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000048b0000"
filename = ""
Region:
id = 374
start_va = 0x6fad0000
end_va = 0x6faecfff
monitored = 0
entry_point = 0x6fad3b10
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\SysWOW64\\dwmapi.dll" (normalized: "c:\\windows\\syswow64\\dwmapi.dll")
Region:
id = 375
start_va = 0x22e0000
end_va = 0x22effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000022e0000"
filename = ""
Region:
id = 376
start_va = 0x2300000
end_va = 0x230ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002300000"
filename = ""
Region:
id = 377
start_va = 0x69400000
end_va = 0x6956afff
monitored = 0
entry_point = 0x6946e360
region_type = mapped_file
name = "gdiplus.dll"
filename = "\\Windows\\WinSxS\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_538a540779726150\\gdiplus.dll")
Region:
id = 378
start_va = 0x49b0000
end_va = 0x4b8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000049b0000"
filename = ""
Region:
id = 379
start_va = 0x4680000
end_va = 0x46bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004680000"
filename = ""
Region:
id = 380
start_va = 0x49b0000
end_va = 0x4aaffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000049b0000"
filename = ""
Region:
id = 381
start_va = 0x4b80000
end_va = 0x4b8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b80000"
filename = ""
Region:
id = 382
start_va = 0x6f700000
end_va = 0x6f8f0fff
monitored = 0
entry_point = 0x6f7e3cd0
region_type = mapped_file
name = "dwrite.dll"
filename = "\\Windows\\SysWOW64\\DWrite.dll" (normalized: "c:\\windows\\syswow64\\dwrite.dll")
Region:
id = 383
start_va = 0x76f80000
end_va = 0x7709efff
monitored = 0
entry_point = 0x76fc5980
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\SysWOW64\\msctf.dll" (normalized: "c:\\windows\\syswow64\\msctf.dll")
Region:
id = 384
start_va = 0x46c0000
end_va = 0x4708fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "~fontcache-system.dat"
filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat")
Region:
id = 385
start_va = 0x22e0000
end_va = 0x22e3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000022e0000"
filename = ""
Region:
id = 386
start_va = 0x4b90000
end_va = 0x5b8ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "~fontcache-fontface.dat"
filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat")
Region:
id = 387
start_va = 0x2300000
end_va = 0x2303fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002300000"
filename = ""
Region:
id = 388
start_va = 0x5b90000
end_va = 0x5c8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005b90000"
filename = ""
Region:
id = 389
start_va = 0x5c90000
end_va = 0x5d8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005c90000"
filename = ""
Region:
id = 390
start_va = 0x5d90000
end_va = 0x6281fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000005d90000"
filename = ""
Region:
id = 391
start_va = 0x48b0000
end_va = 0x496cfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "micross.ttf"
filename = "\\Windows\\Fonts\\micross.ttf" (normalized: "c:\\windows\\fonts\\micross.ttf")
Region:
id = 392
start_va = 0x49a0000
end_va = 0x49affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000049a0000"
filename = ""
Region:
id = 393
start_va = 0x6290000
end_va = 0x668ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006290000"
filename = ""
Region:
id = 394
start_va = 0x6690000
end_va = 0x76cffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "staticcache.dat"
filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")
Region:
id = 395
start_va = 0x2310000
end_va = 0x2310fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002310000"
filename = ""
Region:
id = 396
start_va = 0x4ab0000
end_va = 0x4b11fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "mscorrc.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll")
Region:
id = 397
start_va = 0x2320000
end_va = 0x232ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002320000"
filename = ""
Region:
id = 398
start_va = 0x4880000
end_va = 0x488ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004880000"
filename = ""
Region:
id = 399
start_va = 0x4890000
end_va = 0x489ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004890000"
filename = ""
Region:
id = 400
start_va = 0x4880000
end_va = 0x4891fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004880000"
filename = ""
Region:
id = 401
start_va = 0x2320000
end_va = 0x232ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002320000"
filename = ""
Region:
id = 402
start_va = 0x4970000
end_va = 0x497ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004970000"
filename = ""
Region:
id = 403
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 404
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 405
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 406
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 407
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 408
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 409
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 410
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 411
start_va = 0x4990000
end_va = 0x499ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004990000"
filename = ""
Region:
id = 412
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 413
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 414
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 415
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 416
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 417
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 418
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 419
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 420
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 421
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 422
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 423
start_va = 0x4990000
end_va = 0x499ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004990000"
filename = ""
Region:
id = 424
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 425
start_va = 0x4990000
end_va = 0x499ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004990000"
filename = ""
Region:
id = 426
start_va = 0x4b20000
end_va = 0x4b2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b20000"
filename = ""
Region:
id = 427
start_va = 0x4b20000
end_va = 0x4b2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b20000"
filename = ""
Region:
id = 428
start_va = 0x4b30000
end_va = 0x4b3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b30000"
filename = ""
Region:
id = 429
start_va = 0x4b30000
end_va = 0x4b3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b30000"
filename = ""
Region:
id = 430
start_va = 0x4b40000
end_va = 0x4b4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b40000"
filename = ""
Region:
id = 431
start_va = 0x4b40000
end_va = 0x4b4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b40000"
filename = ""
Region:
id = 432
start_va = 0x4b40000
end_va = 0x4b4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b40000"
filename = ""
Region:
id = 433
start_va = 0x4b50000
end_va = 0x4b5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b50000"
filename = ""
Region:
id = 434
start_va = 0x4b50000
end_va = 0x4b5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b50000"
filename = ""
Region:
id = 435
start_va = 0x4b60000
end_va = 0x4b6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b60000"
filename = ""
Region:
id = 436
start_va = 0x4b70000
end_va = 0x4b7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b70000"
filename = ""
Region:
id = 437
start_va = 0x76d0000
end_va = 0x76dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000076d0000"
filename = ""
Region:
id = 438
start_va = 0x76e0000
end_va = 0x76effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000076e0000"
filename = ""
Region:
id = 439
start_va = 0x76f0000
end_va = 0x76fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000076f0000"
filename = ""
Region:
id = 440
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 441
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 442
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 443
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 444
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 445
start_va = 0x4990000
end_va = 0x499ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004990000"
filename = ""
Region:
id = 446
start_va = 0x4b20000
end_va = 0x4b2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b20000"
filename = ""
Region:
id = 447
start_va = 0x4b20000
end_va = 0x4b5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b20000"
filename = ""
Region:
id = 448
start_va = 0x76d0000
end_va = 0x77cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000076d0000"
filename = ""
Region:
id = 449
start_va = 0x590000
end_va = 0x59ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000590000"
filename = ""
Region:
id = 450
start_va = 0x77d0000
end_va = 0x780ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000077d0000"
filename = ""
Region:
id = 451
start_va = 0x7810000
end_va = 0x790ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007810000"
filename = ""
Region:
id = 452
start_va = 0x5a0000
end_va = 0x5affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005a0000"
filename = ""
Region:
id = 453
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 454
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 455
start_va = 0x700000
end_va = 0x70ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000700000"
filename = ""
Region:
id = 456
start_va = 0x710000
end_va = 0x71ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000710000"
filename = ""
Region:
id = 457
start_va = 0x720000
end_va = 0x72ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000720000"
filename = ""
Region:
id = 458
start_va = 0x730000
end_va = 0x73ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000730000"
filename = ""
Region:
id = 459
start_va = 0x740000
end_va = 0x74ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000740000"
filename = ""
Region:
id = 460
start_va = 0x750000
end_va = 0x75ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000750000"
filename = ""
Region:
id = 461
start_va = 0x760000
end_va = 0x76ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000760000"
filename = ""
Region:
id = 462
start_va = 0x770000
end_va = 0x77ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000770000"
filename = ""
Region:
id = 463
start_va = 0x780000
end_va = 0x78ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000780000"
filename = ""
Region:
id = 464
start_va = 0x790000
end_va = 0x79ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000790000"
filename = ""
Region:
id = 465
start_va = 0x7a0000
end_va = 0x7affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000007a0000"
filename = ""
Region:
id = 466
start_va = 0x7b0000
end_va = 0x7bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000007b0000"
filename = ""
Region:
id = 467
start_va = 0x7c0000
end_va = 0x7cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000007c0000"
filename = ""
Region:
id = 468
start_va = 0x7d0000
end_va = 0x7dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000007d0000"
filename = ""
Region:
id = 469
start_va = 0x68ce0000
end_va = 0x693f1fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.core.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\abad45b9cc652ba7e38c4c837234c0ab\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\abad45b9cc652ba7e38c4c837234c0ab\\system.core.ni.dll")
Region:
id = 470
start_va = 0x5a0000
end_va = 0x5affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005a0000"
filename = ""
Region:
id = 471
start_va = 0x5a0000
end_va = 0x5affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005a0000"
filename = ""
Region:
id = 472
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 473
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 474
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 475
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 476
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 477
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 478
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 479
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 480
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 481
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 482
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 483
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 484
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 485
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 486
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 487
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 488
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 489
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 490
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 491
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 492
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 493
start_va = 0x70040000
end_va = 0x70052fff
monitored = 0
entry_point = 0x70049950
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")
Region:
id = 494
start_va = 0x700000
end_va = 0x73ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000700000"
filename = ""
Region:
id = 495
start_va = 0x7910000
end_va = 0x7a0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007910000"
filename = ""
Region:
id = 496
start_va = 0x70010000
end_va = 0x7003efff
monitored = 0
entry_point = 0x700295e0
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 497
start_va = 0x73e30000
end_va = 0x73e4afff
monitored = 0
entry_point = 0x73e39050
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")
Region:
id = 498
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 499
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 500
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 501
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 502
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 503
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 504
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 505
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 506
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 507
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 508
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 509
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 510
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 511
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 512
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 513
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 514
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 515
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 516
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 517
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 518
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 519
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 520
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 521
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 522
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 523
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 524
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 525
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 526
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 527
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 528
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 529
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 530
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 531
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 532
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 533
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 534
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 535
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 536
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 537
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 538
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 539
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 540
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 541
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 542
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 543
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 544
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 545
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 546
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 547
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 548
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 549
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 550
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 551
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 552
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 553
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 554
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 555
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 556
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 557
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 558
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 559
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 560
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 561
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 562
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 563
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 564
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 565
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 566
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 567
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 568
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 569
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 570
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 571
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 572
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 573
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 574
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 575
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 576
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 577
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 578
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 579
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 580
start_va = 0x5b0000
end_va = 0x5bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005b0000"
filename = ""
Region:
id = 581
start_va = 0x740000
end_va = 0x7bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000740000"
filename = ""
Region:
id = 582
start_va = 0x7a10000
end_va = 0x7b0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007a10000"
filename = ""
Region:
id = 583
start_va = 0x68b60000
end_va = 0x68cd2fff
monitored = 0
entry_point = 0x68c0d220
region_type = mapped_file
name = "windowscodecs.dll"
filename = "\\Windows\\SysWOW64\\WindowsCodecs.dll" (normalized: "c:\\windows\\syswow64\\windowscodecs.dll")
Region:
id = 584
start_va = 0x7b10000
end_va = 0x7b88fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007b10000"
filename = ""
Region:
id = 585
start_va = 0x7c0000
end_va = 0x7effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000007c0000"
filename = ""
Region:
id = 586
start_va = 0x7c0000
end_va = 0x7cffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007c0000"
filename = ""
Region:
id = 587
start_va = 0x7d0000
end_va = 0x7dffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007d0000"
filename = ""
Region:
id = 588
start_va = 0x7e0000
end_va = 0x7effff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007e0000"
filename = ""
Region:
id = 589
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 590
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 591
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 592
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 593
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 594
start_va = 0x7b90000
end_va = 0x7c07fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000007b90000"
filename = ""
Region:
id = 595
start_va = 0x5c0000
end_va = 0x5cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 596
start_va = 0x7f0000
end_va = 0x7fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000007f0000"
filename = ""
Region:
id = 597
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 598
start_va = 0x4990000
end_va = 0x499ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004990000"
filename = ""
Region:
id = 599
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 600
start_va = 0x4990000
end_va = 0x499ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004990000"
filename = ""
Region:
id = 601
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 602
start_va = 0x4990000
end_va = 0x499ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004990000"
filename = ""
Region:
id = 603
start_va = 0x4b60000
end_va = 0x4b6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b60000"
filename = ""
Region:
id = 604
start_va = 0x4b70000
end_va = 0x4b7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b70000"
filename = ""
Region:
id = 605
start_va = 0x7c10000
end_va = 0x7c1ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c10000"
filename = ""
Region:
id = 606
start_va = 0x7c20000
end_va = 0x7c2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c20000"
filename = ""
Region:
id = 607
start_va = 0x7c30000
end_va = 0x7c3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c30000"
filename = ""
Region:
id = 608
start_va = 0x7c40000
end_va = 0x7c4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c40000"
filename = ""
Region:
id = 609
start_va = 0x7c50000
end_va = 0x7c5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c50000"
filename = ""
Region:
id = 610
start_va = 0x7c60000
end_va = 0x7c6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c60000"
filename = ""
Region:
id = 611
start_va = 0x7c70000
end_va = 0x7c7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c70000"
filename = ""
Region:
id = 612
start_va = 0x7c80000
end_va = 0x7c8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c80000"
filename = ""
Region:
id = 613
start_va = 0x7c90000
end_va = 0x7c9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c90000"
filename = ""
Region:
id = 614
start_va = 0x7ca0000
end_va = 0x7caffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007ca0000"
filename = ""
Region:
id = 615
start_va = 0x7cb0000
end_va = 0x7cbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007cb0000"
filename = ""
Region:
id = 616
start_va = 0x7cc0000
end_va = 0x7ccffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007cc0000"
filename = ""
Region:
id = 617
start_va = 0x7cd0000
end_va = 0x7cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007cd0000"
filename = ""
Region:
id = 618
start_va = 0x7ce0000
end_va = 0x7ceffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007ce0000"
filename = ""
Region:
id = 619
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 620
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 621
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 622
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 623
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 624
start_va = 0x4980000
end_va = 0x498ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004980000"
filename = ""
Region:
id = 625
start_va = 0x4990000
end_va = 0x499ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004990000"
filename = ""
Region:
id = 626
start_va = 0x4990000
end_va = 0x499ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004990000"
filename = ""
Region:
id = 627
start_va = 0x4b60000
end_va = 0x4b6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b60000"
filename = ""
Region:
id = 628
start_va = 0x7c10000
end_va = 0x7c4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c10000"
filename = ""
Region:
id = 629
start_va = 0x7cf0000
end_va = 0x7deffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007cf0000"
filename = ""
Region:
id = 630
start_va = 0x4990000
end_va = 0x499ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004990000"
filename = ""
Region:
id = 631
start_va = 0x741b0000
end_va = 0x755aefff
monitored = 0
entry_point = 0x7436b990
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")
Region:
id = 632
start_va = 0x7df0000
end_va = 0x7eeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007df0000"
filename = ""
Region:
id = 633
start_va = 0x75940000
end_va = 0x75976fff
monitored = 0
entry_point = 0x75943b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")
Region:
id = 634
start_va = 0x75f10000
end_va = 0x76408fff
monitored = 0
entry_point = 0x76117610
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")
Region:
id = 635
start_va = 0x76cf0000
end_va = 0x76d7cfff
monitored = 0
entry_point = 0x76d39b90
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")
Region:
id = 636
start_va = 0x766e0000
end_va = 0x76723fff
monitored = 0
entry_point = 0x766e7410
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")
Region:
id = 637
start_va = 0x77450000
end_va = 0x7745efff
monitored = 0
entry_point = 0x77452e40
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")
Region:
id = 638
start_va = 0x4990000
end_va = 0x4990fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004990000"
filename = ""
Region:
id = 639
start_va = 0x701d0000
end_va = 0x701f7fff
monitored = 0
entry_point = 0x701d7820
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\SysWOW64\\ntmarta.dll" (normalized: "c:\\windows\\syswow64\\ntmarta.dll")
Region:
id = 640
start_va = 0x4b60000
end_va = 0x4b6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b60000"
filename = ""
Region:
id = 641
start_va = 0x4b60000
end_va = 0x4b6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b60000"
filename = ""
Region:
id = 642
start_va = 0x4b60000
end_va = 0x4b6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b60000"
filename = ""
Region:
id = 643
start_va = 0x4b60000
end_va = 0x4b6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b60000"
filename = ""
Region:
id = 644
start_va = 0x4b60000
end_va = 0x4b6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b60000"
filename = ""
Region:
id = 645
start_va = 0x68ae0000
end_va = 0x68b50fff
monitored = 0
entry_point = 0x68b369e0
region_type = mapped_file
name = "efswrt.dll"
filename = "\\Windows\\SysWOW64\\efswrt.dll" (normalized: "c:\\windows\\syswow64\\efswrt.dll")
Region:
id = 646
start_va = 0x73d60000
end_va = 0x73e27fff
monitored = 0
entry_point = 0x73dcae90
region_type = mapped_file
name = "wintypes.dll"
filename = "\\Windows\\SysWOW64\\WinTypes.dll" (normalized: "c:\\windows\\syswow64\\wintypes.dll")
Region:
id = 647
start_va = 0x715b0000
end_va = 0x715f8fff
monitored = 0
entry_point = 0x715b6450
region_type = mapped_file
name = "edputil.dll"
filename = "\\Windows\\SysWOW64\\edputil.dll" (normalized: "c:\\windows\\syswow64\\edputil.dll")
Region:
id = 648
start_va = 0x4b60000
end_va = 0x4b6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b60000"
filename = ""
Region:
id = 649
start_va = 0x4b60000
end_va = 0x4b6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b60000"
filename = ""
Region:
id = 650
start_va = 0x689c0000
end_va = 0x68adbfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.management.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\d2f554a0c84513cd793fdcd77a86dab1\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\d2f554a0c84513cd793fdcd77a86dab1\\system.management.ni.dll")
Region:
id = 651
start_va = 0x4b60000
end_va = 0x4b6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b60000"
filename = ""
Region:
id = 652
start_va = 0x7c50000
end_va = 0x7c8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c50000"
filename = ""
Region:
id = 653
start_va = 0x7ef0000
end_va = 0x7feffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007ef0000"
filename = ""
Region:
id = 654
start_va = 0x72120000
end_va = 0x7226afff
monitored = 0
entry_point = 0x72181660
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\SysWOW64\\propsys.dll" (normalized: "c:\\windows\\syswow64\\propsys.dll")
Region:
id = 655
start_va = 0x7c90000
end_va = 0x7ccffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c90000"
filename = ""
Region:
id = 656
start_va = 0x7ff0000
end_va = 0x80effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007ff0000"
filename = ""
Region:
id = 657
start_va = 0x4b70000
end_va = 0x4b70fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004b70000"
filename = ""
Region:
id = 658
start_va = 0x76730000
end_va = 0x767b3fff
monitored = 0
entry_point = 0x76756220
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")
Region:
id = 659
start_va = 0x73a70000
end_va = 0x73c8bfff
monitored = 0
entry_point = 0x73c3bc40
region_type = mapped_file
name = "actxprxy.dll"
filename = "\\Windows\\SysWOW64\\actxprxy.dll" (normalized: "c:\\windows\\syswow64\\actxprxy.dll")
Region:
id = 660
start_va = 0x7cd0000
end_va = 0x7cd0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000007cd0000"
filename = ""
Region:
id = 661
start_va = 0x80f0000
end_va = 0x812ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000080f0000"
filename = ""
Region:
id = 662
start_va = 0x8130000
end_va = 0x822ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008130000"
filename = ""
Region:
id = 663
start_va = 0x8230000
end_va = 0x8233fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.1.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")
Region:
id = 664
start_va = 0x8240000
end_va = 0x8256fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000d.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000d.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000d.db")
Region:
id = 665
start_va = 0x8260000
end_va = 0x8260fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000008260000"
filename = ""
Region:
id = 666
start_va = 0x8230000
end_va = 0x8233fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 667
start_va = 0x8270000
end_va = 0x82affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008270000"
filename = ""
Region:
id = 668
start_va = 0x82b0000
end_va = 0x83affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000082b0000"
filename = ""
Region:
id = 669
start_va = 0x83b0000
end_va = 0x83f4fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db")
Region:
id = 670
start_va = 0x8400000
end_va = 0x8403fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 671
start_va = 0x8410000
end_va = 0x849dfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")
Region:
id = 672
start_va = 0x84a0000
end_va = 0x84a1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000084a0000"
filename = ""
Region:
id = 673
start_va = 0x84b0000
end_va = 0x84b0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000084b0000"
filename = ""
Region:
id = 674
start_va = 0x84c0000
end_va = 0x88bafff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000084c0000"
filename = ""
Region:
id = 675
start_va = 0x705b0000
end_va = 0x7072dfff
monitored = 0
entry_point = 0x7062c630
region_type = mapped_file
name = "urlmon.dll"
filename = "\\Windows\\SysWOW64\\urlmon.dll" (normalized: "c:\\windows\\syswow64\\urlmon.dll")
Region:
id = 676
start_va = 0x71cf0000
end_va = 0x71fbafff
monitored = 0
entry_point = 0x71f2c4c0
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\SysWOW64\\iertutil.dll" (normalized: "c:\\windows\\syswow64\\iertutil.dll")
Region:
id = 677
start_va = 0x88c0000
end_va = 0x88c0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000088c0000"
filename = ""
Region:
id = 1458
start_va = 0x7c50000
end_va = 0x7c5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c50000"
filename = ""
Region:
id = 1459
start_va = 0x7c60000
end_va = 0x7c6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c60000"
filename = ""
Region:
id = 1460
start_va = 0x7c70000
end_va = 0x7c7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c70000"
filename = ""
Region:
id = 1461
start_va = 0x7c80000
end_va = 0x7c8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c80000"
filename = ""
Region:
id = 1462
start_va = 0x7ef0000
end_va = 0x7efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007ef0000"
filename = ""
Region:
id = 1463
start_va = 0x7f00000
end_va = 0x7f0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f00000"
filename = ""
Region:
id = 1464
start_va = 0x7f10000
end_va = 0x7f1ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f10000"
filename = ""
Region:
id = 1465
start_va = 0x7f20000
end_va = 0x7f2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f20000"
filename = ""
Region:
id = 1466
start_va = 0x7f30000
end_va = 0x7f3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f30000"
filename = ""
Region:
id = 1467
start_va = 0x7f40000
end_va = 0x7f4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f40000"
filename = ""
Region:
id = 1468
start_va = 0x7f50000
end_va = 0x7f5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f50000"
filename = ""
Region:
id = 1469
start_va = 0x7f60000
end_va = 0x7f6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f60000"
filename = ""
Region:
id = 1470
start_va = 0x7f70000
end_va = 0x7f7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f70000"
filename = ""
Region:
id = 1471
start_va = 0x7f80000
end_va = 0x7f8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f80000"
filename = ""
Region:
id = 1472
start_va = 0x7f90000
end_va = 0x7f9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f90000"
filename = ""
Region:
id = 1473
start_va = 0x7fa0000
end_va = 0x7faffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007fa0000"
filename = ""
Region:
id = 1474
start_va = 0x7fb0000
end_va = 0x7fbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007fb0000"
filename = ""
Region:
id = 1475
start_va = 0x7fc0000
end_va = 0x7fcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007fc0000"
filename = ""
Region:
id = 1476
start_va = 0x7fd0000
end_va = 0x7fdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007fd0000"
filename = ""
Region:
id = 1477
start_va = 0x7fe0000
end_va = 0x7feffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007fe0000"
filename = ""
Region:
id = 1478
start_va = 0x7c50000
end_va = 0x7c86fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000007c50000"
filename = ""
Region:
id = 1479
start_va = 0x7ef0000
end_va = 0x7efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007ef0000"
filename = ""
Region:
id = 1480
start_va = 0x7f00000
end_va = 0x7f0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f00000"
filename = ""
Region:
id = 1481
start_va = 0x7f10000
end_va = 0x7f1ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f10000"
filename = ""
Region:
id = 1495
start_va = 0x7fb00000
end_va = 0x7fea0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\sysmain.sdb")
Region:
id = 1519
start_va = 0x7ef0000
end_va = 0x7f2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007ef0000"
filename = ""
Region:
id = 1520
start_va = 0x88d0000
end_va = 0x89cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000088d0000"
filename = ""
Region:
id = 1534
start_va = 0x7f30000
end_va = 0x7f6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f30000"
filename = ""
Region:
id = 1535
start_va = 0x89d0000
end_va = 0x8acffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000089d0000"
filename = ""
Thread:
id = 1
os_tid = 0x4c4
[0133.599] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0
[0134.346] RoInitialize () returned 0x1
[0134.347] RoUninitialize () returned 0x0
[0136.451] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", nBufferLength=0x105, lpBuffer=0x19ef18, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll", lpFilePart=0x0) returned 0x77
[0136.471] IsAppThemed () returned 0x1
[0136.474] CoTaskMemAlloc (cb=0xf0) returned 0x4e5440
[0136.475] CreateActCtxA (pActCtx=0x19f414) returned 0x4e4884
[0136.561] CoTaskMemFree (pv=0x4e5440)
[0136.591] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLNAME") returned 0xc1dd
[0136.591] RegisterClipboardFormatW (lpszFormat="WM_GETCONTROLTYPE") returned 0xc1d9
[0136.887] GetSystemMetrics (nIndex=75) returned 1
[0136.893] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0
[0137.600] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x69570000
[0137.636] AdjustWindowRectEx (in: lpRect=0x19f43c, dwStyle=0x56cf0000, bMenu=0, dwExStyle=0x50001 | out: lpRect=0x19f43c) returned 1
[0137.639] GetCurrentProcess () returned 0xffffffff
[0137.639] GetCurrentThread () returned 0xfffffffe
[0137.639] GetCurrentProcess () returned 0xffffffff
[0137.639] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0xfffffffe, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19f354, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19f354*=0x270) returned 1
[0137.652] GetCurrentThreadId () returned 0x4c4
[0137.664] GetCurrentActCtx (in: lphActCtx=0x19f2b4 | out: lphActCtx=0x19f2b4*=0x0) returned 1
[0137.665] ActivateActCtx (in: hActCtx=0x4e4884, lpCookie=0x19f2c4 | out: hActCtx=0x4e4884, lpCookie=0x19f2c4) returned 1
[0137.665] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x0
[0138.779] LoadLibraryW (lpLibFileName="comctl32.dll") returned 0x6e840000
[0138.796] GetModuleHandleW (lpModuleName="user32.dll") returned 0x755e0000
[0138.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x19f17c, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW\x80i\x8e/\x93R «þkhö\x19", lpUsedDefaultChar=0x0) returned 14
[0138.797] GetProcAddress (hModule=0x755e0000, lpProcName="DefWindowProcW") returned 0x741107e0
[0138.886] GetStockObject (i=5) returned 0x1900015
[0138.914] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0138.919] CoTaskMemAlloc (cb=0x5c) returned 0x4ec400
[0138.919] RegisterClassW (lpWndClass=0x19f16c) returned 0xc150
[0138.919] CoTaskMemFree (pv=0x4ec400)
[0138.920] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0138.920] CreateWindowExW (dwExStyle=0x0, lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", lpWindowName=0x0, dwStyle=0x2010000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0xfffffffd, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x801ec
[0138.921] SetWindowLongW (hWnd=0x801ec, nIndex=-4, dwNewLong=1947273184) returned 77202878
[0138.922] GetWindowLongW (hWnd=0x801ec, nIndex=-4) returned 1947273184
[0138.927] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\.NETFramework", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e9cc | out: phkResult=0x19e9cc*=0x290) returned 0x0
[0138.928] RegQueryValueExW (in: hKey=0x290, lpValueName="DbgJITDebugLaunchSetting", lpReserved=0x0, lpType=0x19e9ec, lpData=0x0, lpcbData=0x19e9e8*=0x0 | out: lpType=0x19e9ec*=0x0, lpData=0x0, lpcbData=0x19e9e8*=0x0) returned 0x2
[0138.928] RegQueryValueExW (in: hKey=0x290, lpValueName="DbgManagedDebugger", lpReserved=0x0, lpType=0x19e9ec, lpData=0x0, lpcbData=0x19e9e8*=0x0 | out: lpType=0x19e9ec*=0x0, lpData=0x0, lpcbData=0x19e9e8*=0x0) returned 0x2
[0138.928] RegCloseKey (hKey=0x290) returned 0x0
[0138.940] SetWindowLongW (hWnd=0x801ec, nIndex=-4, dwNewLong=77202918) returned 1947273184
[0138.941] GetWindowLongW (hWnd=0x801ec, nIndex=-4) returned 77202918
[0138.941] GetWindowLongW (hWnd=0x801ec, nIndex=-16) returned 113311744
[0138.942] RegisterClipboardFormatW (lpszFormat="WinFormsMouseEnter") returned 0xc1c5
[0138.947] CallWindowProcW (lpPrevWndFunc=0x741107e0, hWnd=0x801ec, Msg=0x24, wParam=0x0, lParam=0x19ece4) returned 0x0
[0138.947] RegisterClipboardFormatW (lpszFormat="WinFormsUnSubclass") returned 0xc1c6
[0138.947] CallWindowProcW (lpPrevWndFunc=0x741107e0, hWnd=0x801ec, Msg=0x81, wParam=0x0, lParam=0x19ecd8) returned 0x1
[0138.948] CallWindowProcW (lpPrevWndFunc=0x741107e0, hWnd=0x801ec, Msg=0x83, wParam=0x0, lParam=0x19ecc4) returned 0x0
[0139.288] CallWindowProcW (lpPrevWndFunc=0x741107e0, hWnd=0x801ec, Msg=0x1, wParam=0x0, lParam=0x19ecd8) returned 0x0
[0139.288] GetClientRect (in: hWnd=0x801ec, lpRect=0x19ea04 | out: lpRect=0x19ea04) returned 1
[0139.288] GetWindowRect (in: hWnd=0x801ec, lpRect=0x19ea04 | out: lpRect=0x19ea04) returned 1
[0139.291] GetParent (hWnd=0x801ec) returned 0x0
[0139.291] DeactivateActCtx (dwFlags=0x0, ulCookie=0x186a0001) returned 1
[0139.391] GetSystemDefaultLCID () returned 0x409
[0139.398] GetStockObject (i=17) returned 0x10a0047
[0139.400] GetObjectW (in: h=0x10a0047, c=92, pv=0x19f108 | out: pv=0x19f108) returned 92
[0139.403] GetDC (hWnd=0x0) returned 0xffffffffd001053c
[0139.974] GdiplusStartup (in: token=0x605ed8, input=0x19e6d0, output=0x19e720 | out: token=0x605ed8, output=0x19e720) returned 0x0
[0139.980] CoTaskMemAlloc (cb=0x5c) returned 0x4ebeb8
[0139.981] GdipCreateFontFromLogfontW (hdc=0xd001053c, logfont=0x4ebeb8, font=0x19f1d0) returned 0x0
[0141.638] CoTaskMemFree (pv=0x4ebeb8)
[0141.639] CoTaskMemAlloc (cb=0x5c) returned 0x4ebeb8
[0141.639] CoTaskMemFree (pv=0x4ebeb8)
[0141.642] CoTaskMemAlloc (cb=0x5c) returned 0x4ebeb8
[0141.642] CoTaskMemFree (pv=0x4ebeb8)
[0141.643] GdipGetFontUnit (font=0x4b81f08, unit=0x19f19c) returned 0x0
[0141.643] GdipGetFontSize (font=0x4b81f08, size=0x19f1a0) returned 0x0
[0141.643] GdipGetFontStyle (font=0x4b81f08, style=0x19f198) returned 0x0
[0141.644] GdipGetFamily (font=0x4b81f08, family=0x19f194) returned 0x0
[0141.644] GdipGetFontSize (font=0x4b81f08, size=0x23489b4) returned 0x0
[0141.644] ReleaseDC (hWnd=0x0, hDC=0xd001053c) returned 1
[0141.645] GetDC (hWnd=0x0) returned 0x35010973
[0141.645] GdipCreateFromHDC (hdc=0x35010973, graphics=0x19f1bc) returned 0x0
[0141.670] GdipGetDpiY (graphics=0x5c9f268, dpi=0x2348abc) returned 0x0
[0141.671] GdipGetFontHeight (font=0x4b81f08, graphics=0x5c9f268, height=0x19f1b4) returned 0x0
[0141.671] GdipGetEmHeight (family=0x5c95e10, style=0, EmHeight=0x19f1bc) returned 0x0
[0141.671] GdipGetLineSpacing (family=0x5c95e10, style=0, LineSpacing=0x19f1bc) returned 0x0
[0141.672] GdipDeleteGraphics (graphics=0x5c9f268) returned 0x0
[0141.676] ReleaseDC (hWnd=0x0, hDC=0x35010973) returned 1
[0141.676] GdipCreateFont (fontFamily=0x5c95e10, emSize=0x41040000, style=0, unit=0x3, font=0x2348a7c) returned 0x0
[0141.676] GdipGetFontSize (font=0x4b8efc0, size=0x2348a80) returned 0x0
[0141.677] GdipDeleteFont (font=0x4b81f08) returned 0x0
[0141.677] GetDC (hWnd=0x0) returned 0x35010973
[0141.677] GdipCreateFromHDC (hdc=0x35010973, graphics=0x19f220) returned 0x0
[0141.677] GdipGetFontHeight (font=0x4b8efc0, graphics=0x5c9f268, height=0x19f218) returned 0x0
[0141.677] GdipDeleteGraphics (graphics=0x5c9f268) returned 0x0
[0141.677] ReleaseDC (hWnd=0x0, hDC=0x35010973) returned 1
[0141.683] GetSystemMetrics (nIndex=5) returned 1
[0141.683] GetSystemMetrics (nIndex=6) returned 1
[0141.683] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.684] AdjustWindowRectEx (in: lpRect=0x19f348, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f348) returned 1
[0141.684] GetDC (hWnd=0x0) returned 0x35010973
[0141.685] GdipCreateFromHDC (hdc=0x35010973, graphics=0x19f220) returned 0x0
[0141.688] GdipGetFontHeight (font=0x4b8efc0, graphics=0x5c9f268, height=0x19f218) returned 0x0
[0141.688] GdipDeleteGraphics (graphics=0x5c9f268) returned 0x0
[0141.688] ReleaseDC (hWnd=0x0, hDC=0x35010973) returned 1
[0141.689] GetSystemMetrics (nIndex=5) returned 1
[0141.689] GetSystemMetrics (nIndex=6) returned 1
[0141.689] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.689] AdjustWindowRectEx (in: lpRect=0x19f348, dwStyle=0x560101c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f348) returned 1
[0141.691] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.692] AdjustWindowRectEx (in: lpRect=0x19f34c, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f34c) returned 1
[0141.692] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.692] AdjustWindowRectEx (in: lpRect=0x19f34c, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f34c) returned 1
[0141.693] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.693] AdjustWindowRectEx (in: lpRect=0x19f348, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f348) returned 1
[0141.693] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.693] AdjustWindowRectEx (in: lpRect=0x19f34c, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f34c) returned 1
[0141.693] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.695] AdjustWindowRectEx (in: lpRect=0x19f34c, dwStyle=0x5601008d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f34c) returned 1
[0141.696] GetSystemMetrics (nIndex=5) returned 1
[0141.696] GetSystemMetrics (nIndex=6) returned 1
[0141.696] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.697] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f2ac) returned 1
[0141.697] GetSystemMetrics (nIndex=5) returned 1
[0141.697] GetSystemMetrics (nIndex=6) returned 1
[0141.697] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.697] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f2ac) returned 1
[0141.699] GetSystemMetrics (nIndex=5) returned 1
[0141.699] GetSystemMetrics (nIndex=6) returned 1
[0141.700] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.700] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f2ac) returned 1
[0141.700] GetSystemMetrics (nIndex=5) returned 1
[0141.700] GetSystemMetrics (nIndex=6) returned 1
[0141.700] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.700] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f2ac) returned 1
[0141.703] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.703] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1
[0141.724] GetProcessWindowStation () returned 0xf0
[0141.726] GetUserObjectInformationA (in: hObj=0xf0, nIndex=1, pvInfo=0x2349d18, nLength=0xc, lpnLengthNeeded=0x19f188 | out: pvInfo=0x2349d18, lpnLengthNeeded=0x19f188) returned 1
[0141.731] SetConsoleCtrlHandler (HandlerRoutine=0x49a060e, Add=1) returned 1
[0141.732] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0141.732] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0141.734] GetClassInfoW (in: hInstance=0x400000, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWndClass=0x2349d7c | out: lpWndClass=0x2349d7c) returned 0
[0141.736] CoTaskMemAlloc (cb=0x58) returned 0x4e6808
[0141.736] RegisterClassW (lpWndClass=0x19f0d8) returned 0xc1df
[0141.736] CoTaskMemFree (pv=0x4e6808)
[0141.737] CreateWindowExW (dwExStyle=0x0, lpClassName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", lpWindowName=".NET-BroadcastEventWindow.4.0.0.0.141b42a.0", dwStyle=0x80000000, X=0, Y=0, nWidth=0, nHeight=0, hWndParent=0x0, hMenu=0x0, hInstance=0x400000, lpParam=0x0) returned 0x50342
[0141.738] NtdllDefWindowProc_W (hWnd=0x50342, Msg=0x81, wParam=0x0, lParam=0x19ec18) returned 0x1
[0141.742] NtdllDefWindowProc_W (hWnd=0x50342, Msg=0x83, wParam=0x0, lParam=0x19ec04) returned 0x0
[0141.742] NtdllDefWindowProc_W (hWnd=0x50342, Msg=0x1, wParam=0x0, lParam=0x19ec18) returned 0x0
[0141.743] NtdllDefWindowProc_W (hWnd=0x50342, Msg=0x5, wParam=0x0, lParam=0x0) returned 0x0
[0141.743] NtdllDefWindowProc_W (hWnd=0x50342, Msg=0x3, wParam=0x0, lParam=0x0) returned 0x0
[0141.747] GetSysColor (nIndex=10) returned 0xb4b4b4
[0141.747] GetSysColor (nIndex=2) returned 0xd1b499
[0141.747] GetSysColor (nIndex=9) returned 0x0
[0141.748] GetSysColor (nIndex=12) returned 0xababab
[0141.748] GetSysColor (nIndex=15) returned 0xf0f0f0
[0141.748] GetSysColor (nIndex=20) returned 0xffffff
[0141.748] GetSysColor (nIndex=16) returned 0xa0a0a0
[0141.748] GetSysColor (nIndex=15) returned 0xf0f0f0
[0141.748] GetSysColor (nIndex=16) returned 0xa0a0a0
[0141.748] GetSysColor (nIndex=21) returned 0x696969
[0141.748] GetSysColor (nIndex=22) returned 0xe3e3e3
[0141.748] GetSysColor (nIndex=20) returned 0xffffff
[0141.748] GetSysColor (nIndex=18) returned 0x0
[0141.748] GetSysColor (nIndex=1) returned 0x0
[0141.748] GetSysColor (nIndex=27) returned 0xead1b9
[0141.748] GetSysColor (nIndex=28) returned 0xf2e4d7
[0141.748] GetSysColor (nIndex=17) returned 0x6d6d6d
[0141.748] GetSysColor (nIndex=13) returned 0xff9933
[0141.748] GetSysColor (nIndex=14) returned 0xffffff
[0141.748] GetSysColor (nIndex=26) returned 0xcc6600
[0141.748] GetSysColor (nIndex=11) returned 0xfcf7f4
[0141.748] GetSysColor (nIndex=3) returned 0xdbcdbf
[0141.748] GetSysColor (nIndex=19) returned 0x0
[0141.748] GetSysColor (nIndex=24) returned 0xe1ffff
[0141.748] GetSysColor (nIndex=23) returned 0x0
[0141.748] GetSysColor (nIndex=4) returned 0xf0f0f0
[0141.748] GetSysColor (nIndex=30) returned 0xf0f0f0
[0141.749] GetSysColor (nIndex=29) returned 0xff9933
[0141.749] GetSysColor (nIndex=7) returned 0x0
[0141.749] GetSysColor (nIndex=0) returned 0xc8c8c8
[0141.749] GetSysColor (nIndex=5) returned 0xffffff
[0141.749] GetSysColor (nIndex=6) returned 0x646464
[0141.749] GetSysColor (nIndex=8) returned 0x0
[0141.749] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.749] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1
[0141.751] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.751] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1
[0141.752] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.752] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1
[0141.752] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.752] AdjustWindowRectEx (in: lpRect=0x19f2d8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2d8) returned 1
[0141.760] GdipCreateFontFamilyFromName (name="Microsoft Sans Serif", fontCollection=0x0, fontFamily=0x19f328) returned 0x0
[0141.764] GdipCreateFont (fontFamily=0x5c95e10, emSize=0x41400000, style=0, unit=0x3, font=0x234a350) returned 0x0
[0141.764] GdipGetFontSize (font=0x4b81f08, size=0x234a354) returned 0x0
[0141.765] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.766] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1
[0141.766] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.766] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1
[0141.766] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.766] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1
[0141.767] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.767] AdjustWindowRectEx (in: lpRect=0x19f2ac, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f2ac) returned 1
[0141.770] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.770] AdjustWindowRectEx (in: lpRect=0x19f30c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f30c) returned 1
[0141.770] GetSystemMetrics (nIndex=59) returned 1456
[0141.770] GetSystemMetrics (nIndex=60) returned 916
[0141.770] GetSystemMetrics (nIndex=34) returned 136
[0141.770] GetSystemMetrics (nIndex=35) returned 39
[0141.770] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.771] AdjustWindowRectEx (in: lpRect=0x19f20c, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f20c) returned 1
[0141.771] GetCurrentThreadId () returned 0x4c4
[0141.771] GetCurrentThreadId () returned 0x4c4
[0141.774] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.774] AdjustWindowRectEx (in: lpRect=0x19f108, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f108) returned 1
[0141.792] GdipGetFamilyName (in: family=0x5c95e10, name=0x19eff8, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0
[0141.792] CreateCompatibleDC (hdc=0x0) returned 0x330106d7
[0141.793] GetCurrentObject (hdc=0x330106d7, type=0x1) returned 0x1b00017
[0141.798] GetCurrentObject (hdc=0x330106d7, type=0x2) returned 0x1900010
[0141.798] GetCurrentObject (hdc=0x330106d7, type=0x7) returned 0x185000f
[0141.798] GetCurrentObject (hdc=0x330106d7, type=0x6) returned 0x18a0048
[0141.801] SaveDC (hdc=0x330106d7) returned 1
[0141.802] GetDeviceCaps (hdc=0x330106d7, index=90) returned 96
[0141.803] CoTaskMemAlloc (cb=0x5c) returned 0x4ec058
[0141.804] CreateFontIndirectW (lplf=0x4ec058) returned 0x520a083c
[0141.804] CoTaskMemFree (pv=0x4ec058)
[0141.807] GetObjectW (in: h=0x520a083c, c=92, pv=0x19efd0 | out: pv=0x19efd0) returned 92
[0141.807] GetCurrentObject (hdc=0x330106d7, type=0x6) returned 0x18a0048
[0141.807] GetObjectW (in: h=0x18a0048, c=92, pv=0x19ef28 | out: pv=0x19ef28) returned 92
[0141.808] SelectObject (hdc=0x330106d7, h=0x520a083c) returned 0x18a0048
[0141.808] GetMapMode (hdc=0x330106d7) returned 1
[0141.808] GetTextMetricsW (in: hdc=0x330106d7, lptm=0x19efdc | out: lptm=0x19efdc) returned 1
[0141.809] DrawTextExW (in: hdc=0x330106d7, lpchText="Author: Ali Umar ", cchText=17, lprc=0x19f0f0, format=0x2400, lpdtp=0x234ab84 | out: lpchText="Author: Ali Umar ", lprc=0x19f0f0) returned 13
[0141.899] GetCurrentThreadId () returned 0x4c4
[0141.899] GetCurrentThreadId () returned 0x4c4
[0141.900] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.900] AdjustWindowRectEx (in: lpRect=0x19f108, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f108) returned 1
[0141.900] GdipGetFamilyName (in: family=0x5c95e10, name=0x19eff8, language=0x409 | out: name="Microsoft Sans Serif") returned 0x0
[0141.900] GetDeviceCaps (hdc=0x330106d7, index=90) returned 96
[0141.900] CoTaskMemAlloc (cb=0x5c) returned 0x4ebf88
[0141.900] CreateFontIndirectW (lplf=0x4ebf88) returned 0x8d0a095f
[0141.900] CoTaskMemFree (pv=0x4ebf88)
[0141.900] GetObjectW (in: h=0x8d0a095f, c=92, pv=0x19efd0 | out: pv=0x19efd0) returned 92
[0141.903] SelectObject (hdc=0x330106d7, h=0x8d0a095f) returned 0x520a083c
[0141.903] GetMapMode (hdc=0x330106d7) returned 1
[0141.903] GetTextMetricsW (in: hdc=0x330106d7, lptm=0x19efdc | out: lptm=0x19efdc) returned 1
[0141.904] DrawTextExW (in: hdc=0x330106d7, lpchText="Welcome, to the simple client/server application.", cchText=49, lprc=0x19f0f0, format=0x2400, lpdtp=0x234ae20 | out: lpchText="Welcome, to the simple client/server application.", lprc=0x19f0f0) returned 20
[0141.943] GetCurrentThreadId () returned 0x4c4
[0141.943] GetCurrentThreadId () returned 0x4c4
[0141.943] GetCurrentThreadId () returned 0x4c4
[0141.943] GetCurrentThreadId () returned 0x4c4
[0141.944] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.944] AdjustWindowRectEx (in: lpRect=0x19f108, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f108) returned 1
[0141.944] SelectObject (hdc=0x330106d7, h=0x520a083c) returned 0x8d0a095f
[0141.944] DrawTextExW (in: hdc=0x330106d7, lpchText="IP Address/Host", cchText=15, lprc=0x19f0f0, format=0x2400, lpdtp=0x234af64 | out: lpchText="IP Address/Host", lprc=0x19f0f0) returned 13
[0141.944] GetCurrentThreadId () returned 0x4c4
[0141.945] GetCurrentThreadId () returned 0x4c4
[0141.945] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.945] AdjustWindowRectEx (in: lpRect=0x19f108, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f108) returned 1
[0141.945] DrawTextExW (in: hdc=0x330106d7, lpchText="Account No", cchText=10, lprc=0x19f0f0, format=0x2400, lpdtp=0x234b074 | out: lpchText="Account No", lprc=0x19f0f0) returned 13
[0141.945] GetCurrentThreadId () returned 0x4c4
[0141.945] GetCurrentThreadId () returned 0x4c4
[0141.945] GetCurrentThreadId () returned 0x4c4
[0141.945] GetCurrentThreadId () returned 0x4c4
[0141.959] CreateCompatibleDC (hdc=0x0) returned 0x1301096f
[0141.960] GetDC (hWnd=0x0) returned 0x35010973
[0141.960] GdipCreateFromHDC (hdc=0x35010973, graphics=0x19f148) returned 0x0
[0141.964] CoTaskMemAlloc (cb=0x5c) returned 0x4ec260
[0141.965] GdipGetLogFontW (font=0x4b8efc0, graphics=0x5c9f268, logfontW=0x4ec260) returned 0x0
[0141.968] CoTaskMemFree (pv=0x4ec260)
[0141.968] CoTaskMemAlloc (cb=0x5c) returned 0x4ec058
[0141.968] CoTaskMemFree (pv=0x4ec058)
[0141.968] CoTaskMemAlloc (cb=0x5c) returned 0x4ec2c8
[0141.968] CoTaskMemFree (pv=0x4ec2c8)
[0141.968] GdipDeleteGraphics (graphics=0x5c9f268) returned 0x0
[0141.969] ReleaseDC (hWnd=0x0, hDC=0x35010973) returned 1
[0141.969] CoTaskMemAlloc (cb=0x5c) returned 0x4ebf20
[0141.969] CreateFontIndirectW (lplf=0x4ebf20) returned 0x160a096d
[0141.969] CoTaskMemFree (pv=0x4ebf20)
[0141.969] SelectObject (hdc=0x1301096f, h=0x160a096d) returned 0x18a0048
[0141.969] GetTextMetricsW (in: hdc=0x1301096f, lptm=0x19f254 | out: lptm=0x19f254) returned 1
[0141.970] GetTextExtentPoint32W (in: hdc=0x1301096f, lpString="abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ", c=52, psizl=0x234b848 | out: psizl=0x234b848) returned 1
[0141.970] SelectObject (hdc=0x1301096f, h=0x18a0048) returned 0x160a096d
[0141.973] DeleteDC (hdc=0x1301096f) returned 1
[0141.973] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.974] AdjustWindowRectEx (in: lpRect=0x19efc0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19efc0) returned 1
[0141.976] GetCursorPos (in: lpPoint=0x234b868 | out: lpPoint=0x234b868*(x=1133, y=238)) returned 1
[0141.978] GetSystemMetrics (nIndex=80) returned 1
[0141.982] MonitorFromPoint (pt=0x46d, dwFlags=0xee) returned 0x10001
[0141.985] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ee9c | out: lpmi=0x19ee9c) returned 1
[0141.985] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1501096f
[0141.986] GetDeviceCaps (hdc=0x1501096f, index=12) returned 32
[0141.986] GetDeviceCaps (hdc=0x1501096f, index=14) returned 1
[0141.986] DeleteDC (hdc=0x1501096f) returned 1
[0141.986] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19eef0 | out: lpmi=0x19eef0) returned 1
[0141.987] AdjustWindowRectEx (in: lpRect=0x19f1e0, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f1e0) returned 1
[0141.988] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.988] AdjustWindowRectEx (in: lpRect=0x19ef38, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19ef38) returned 1
[0141.988] GetCursorPos (in: lpPoint=0x234bb9c | out: lpPoint=0x234bb9c*(x=1143, y=238)) returned 1
[0141.989] MonitorFromPoint (pt=0x477, dwFlags=0xee) returned 0x10001
[0141.989] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ee14 | out: lpmi=0x19ee14) returned 1
[0141.989] CreateDCW (pwszDriver="\\\\.\\DISPLAY1", pwszDevice=0x0, pszPort=0x0, pdm=0x0) returned 0x1601096f
[0141.989] GetDeviceCaps (hdc=0x1601096f, index=12) returned 32
[0141.989] GetDeviceCaps (hdc=0x1601096f, index=14) returned 1
[0141.989] DeleteDC (hdc=0x1601096f) returned 1
[0141.990] GetMonitorInfoW (in: hMonitor=0x10001, lpmi=0x19ee68 | out: lpmi=0x19ee68) returned 1
[0141.990] AdjustWindowRectEx (in: lpRect=0x19f018, dwStyle=0x2cf0000, bMenu=0, dwExStyle=0x50000 | out: lpRect=0x19f018) returned 1
[0141.990] GetSystemMetrics (nIndex=34) returned 136
[0141.990] GetSystemMetrics (nIndex=35) returned 39
[0141.990] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.990] AdjustWindowRectEx (in: lpRect=0x19f1d8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1d8) returned 1
[0141.991] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.991] AdjustWindowRectEx (in: lpRect=0x19f03c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f03c) returned 1
[0141.991] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.991] AdjustWindowRectEx (in: lpRect=0x19ee98, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee98) returned 1
[0141.992] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.992] AdjustWindowRectEx (in: lpRect=0x19f1d8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1d8) returned 1
[0141.992] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.992] AdjustWindowRectEx (in: lpRect=0x19f03c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f03c) returned 1
[0141.992] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.992] AdjustWindowRectEx (in: lpRect=0x19ee98, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee98) returned 1
[0141.993] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.993] AdjustWindowRectEx (in: lpRect=0x19f1d8, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1d8) returned 1
[0141.993] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.993] AdjustWindowRectEx (in: lpRect=0x19f03c, dwStyle=0x5601000b, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f03c) returned 1
[0141.994] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.995] AdjustWindowRectEx (in: lpRect=0x19f1d8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1d8) returned 1
[0141.996] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.996] AdjustWindowRectEx (in: lpRect=0x19f03c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f03c) returned 1
[0141.996] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.996] AdjustWindowRectEx (in: lpRect=0x19ee98, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee98) returned 1
[0141.996] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.996] AdjustWindowRectEx (in: lpRect=0x19f1d8, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f1d8) returned 1
[0141.996] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.996] AdjustWindowRectEx (in: lpRect=0x19f03c, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19f03c) returned 1
[0141.997] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.997] AdjustWindowRectEx (in: lpRect=0x19ee98, dwStyle=0x5600000d, bMenu=0, dwExStyle=0x0 | out: lpRect=0x19ee98) returned 1
[0141.997] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.997] AdjustWindowRectEx (in: lpRect=0x19f1d8, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f1d8) returned 1
[0141.997] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.997] AdjustWindowRectEx (in: lpRect=0x19f03c, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f03c) returned 1
[0141.997] GetSystemMetrics (nIndex=5) returned 1
[0141.997] GetSystemMetrics (nIndex=6) returned 1
[0141.997] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.997] AdjustWindowRectEx (in: lpRect=0x19f1d8, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f1d8) returned 1
[0141.998] GetModuleHandleW (lpModuleName="comctl32.dll") returned 0x69570000
[0141.998] AdjustWindowRectEx (in: lpRect=0x19f03c, dwStyle=0x560100c0, bMenu=0, dwExStyle=0x200 | out: lpRect=0x19f03c) returned 1
[0141.998] GetSystemMetrics (nIndex=5) returned 1
[0141.998] GetSystemMetrics (nIndex=6) returned 1
[0142.075] EtwEventRegister (in: ProviderId=0x234c39c, EnableCallback=0x49a065e, CallbackContext=0x0, RegHandle=0x234c378 | out: RegHandle=0x234c378) returned 0x0
[0142.079] EtwEventSetInformation (RegHandle=0x4da320, InformationClass=0x2c, EventInformation=0x2, InformationLength=0x234c30c) returned 0x0
[0142.117] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe.config", nBufferLength=0x105, lpBuffer=0x19ebdc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe.config", lpFilePart=0x0) returned 0x69
[0142.118] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f070) returned 1
[0142.118] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19f0ec | out: lpFileInformation=0x19f0ec*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0142.119] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f06c) returned 1
[0142.865] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x11400, lpName=0x0) returned 0x2d0
[0142.865] memcpy (in: _Dst=0x4880000, _Src=0x234eaec, _Size=0x11400 | out: _Dst=0x4880000) returned 0x4880000
[0142.866] CloseHandle (hObject=0x2d0) returned 1
[0191.790] GdipLoadImageFromStream (stream=0x5b0030, image=0x19e530) returned 0x0
[0192.077] GdipImageForceValidation (image=0x5c9f268) returned 0x0
[0192.087] GdipGetImageType (image=0x5c9f268, type=0x19e52c) returned 0x0
[0192.087] GdipGetImageRawFormat (image=0x5c9f268, format=0x19e4ac*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0))) returned 0x0
[0192.107] GdipGetImageWidth (image=0x5c9f268, width=0x19ea90) returned 0x0
[0192.107] GdipGetImageHeight (image=0x5c9f268, height=0x19ea90) returned 0x0
[0192.122] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.123] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.123] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=0, color=0x19ea80) returned 0x0
[0192.139] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.139] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.139] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=1, color=0x19ea80) returned 0x0
[0192.139] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.139] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.140] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=2, color=0x19ea80) returned 0x0
[0192.140] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.140] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.140] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=3, color=0x19ea80) returned 0x0
[0192.140] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.140] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.140] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=4, color=0x19ea80) returned 0x0
[0192.140] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.140] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.140] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=5, color=0x19ea80) returned 0x0
[0192.140] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.140] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.140] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=6, color=0x19ea80) returned 0x0
[0192.140] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.140] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.140] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=7, color=0x19ea80) returned 0x0
[0192.140] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.141] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.141] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=8, color=0x19ea80) returned 0x0
[0192.141] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.141] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.141] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=9, color=0x19ea80) returned 0x0
[0192.141] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.141] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.141] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=10, color=0x19ea80) returned 0x0
[0192.141] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.141] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.141] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=11, color=0x19ea80) returned 0x0
[0192.141] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.141] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.141] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=12, color=0x19ea80) returned 0x0
[0192.142] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.142] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.142] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=13, color=0x19ea80) returned 0x0
[0192.142] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.142] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.142] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=14, color=0x19ea80) returned 0x0
[0192.142] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.142] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.142] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=15, color=0x19ea80) returned 0x0
[0192.142] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.142] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.142] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=16, color=0x19ea80) returned 0x0
[0192.143] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.143] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.143] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=17, color=0x19ea80) returned 0x0
[0192.143] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.143] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.143] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=18, color=0x19ea80) returned 0x0
[0192.143] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.143] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.143] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=19, color=0x19ea80) returned 0x0
[0192.143] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.143] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.143] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=20, color=0x19ea80) returned 0x0
[0192.143] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.143] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.143] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=21, color=0x19ea80) returned 0x0
[0192.143] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.143] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.144] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=22, color=0x19ea80) returned 0x0
[0192.144] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.144] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.144] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=23, color=0x19ea80) returned 0x0
[0192.144] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.144] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.144] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=24, color=0x19ea80) returned 0x0
[0192.144] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.144] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.144] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=25, color=0x19ea80) returned 0x0
[0192.144] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.144] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.144] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=26, color=0x19ea80) returned 0x0
[0192.144] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.144] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.144] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=27, color=0x19ea80) returned 0x0
[0192.144] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.144] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.144] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=28, color=0x19ea80) returned 0x0
[0192.144] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.145] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.145] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=29, color=0x19ea80) returned 0x0
[0192.145] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.145] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.145] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=30, color=0x19ea80) returned 0x0
[0192.145] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.145] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.145] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=31, color=0x19ea80) returned 0x0
[0192.145] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.145] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.145] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=32, color=0x19ea80) returned 0x0
[0192.145] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.145] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.145] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=33, color=0x19ea80) returned 0x0
[0192.145] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.145] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.145] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=34, color=0x19ea80) returned 0x0
[0192.145] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.145] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.145] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=35, color=0x19ea80) returned 0x0
[0192.145] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.145] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.146] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=36, color=0x19ea80) returned 0x0
[0192.146] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.146] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.146] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=37, color=0x19ea80) returned 0x0
[0192.146] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.146] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.146] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=38, color=0x19ea80) returned 0x0
[0192.146] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.146] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.146] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=39, color=0x19ea80) returned 0x0
[0192.146] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.146] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.146] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=40, color=0x19ea80) returned 0x0
[0192.146] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.146] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.146] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=41, color=0x19ea80) returned 0x0
[0192.146] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.146] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.146] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=42, color=0x19ea80) returned 0x0
[0192.146] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.146] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.146] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=43, color=0x19ea80) returned 0x0
[0192.147] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.147] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.147] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=44, color=0x19ea80) returned 0x0
[0192.147] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.147] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.147] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=45, color=0x19ea80) returned 0x0
[0192.147] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.147] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.147] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=46, color=0x19ea80) returned 0x0
[0192.147] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.147] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.147] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=47, color=0x19ea80) returned 0x0
[0192.147] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.147] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.147] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=48, color=0x19ea80) returned 0x0
[0192.147] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.147] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.147] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=49, color=0x19ea80) returned 0x0
[0192.147] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.147] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.147] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=50, color=0x19ea80) returned 0x0
[0192.148] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.148] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.148] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=51, color=0x19ea80) returned 0x0
[0192.148] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.148] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.148] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=52, color=0x19ea80) returned 0x0
[0192.148] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.148] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.148] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=53, color=0x19ea80) returned 0x0
[0192.148] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.148] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.148] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=54, color=0x19ea80) returned 0x0
[0192.148] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.148] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.148] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=55, color=0x19ea80) returned 0x0
[0192.148] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.148] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.148] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=56, color=0x19ea80) returned 0x0
[0192.148] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.148] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.149] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=57, color=0x19ea80) returned 0x0
[0192.149] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.149] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.149] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=58, color=0x19ea80) returned 0x0
[0192.149] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.149] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.149] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=59, color=0x19ea80) returned 0x0
[0192.149] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.149] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.149] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=60, color=0x19ea80) returned 0x0
[0192.149] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.149] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.149] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=61, color=0x19ea80) returned 0x0
[0192.149] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.149] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.149] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=62, color=0x19ea80) returned 0x0
[0192.149] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.149] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.149] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=63, color=0x19ea80) returned 0x0
[0192.150] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.150] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.150] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=64, color=0x19ea80) returned 0x0
[0192.150] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.150] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.150] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=65, color=0x19ea80) returned 0x0
[0192.150] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.150] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.150] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=66, color=0x19ea80) returned 0x0
[0192.150] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.150] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.150] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=67, color=0x19ea80) returned 0x0
[0192.150] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.150] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.150] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=68, color=0x19ea80) returned 0x0
[0192.150] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.150] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.150] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=69, color=0x19ea80) returned 0x0
[0192.150] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.150] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.150] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=70, color=0x19ea80) returned 0x0
[0192.151] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.151] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.151] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=71, color=0x19ea80) returned 0x0
[0192.151] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.151] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.151] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=72, color=0x19ea80) returned 0x0
[0192.151] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.151] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.151] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=73, color=0x19ea80) returned 0x0
[0192.151] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.151] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.151] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=74, color=0x19ea80) returned 0x0
[0192.151] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.151] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.151] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=75, color=0x19ea80) returned 0x0
[0192.151] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.151] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.151] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=76, color=0x19ea80) returned 0x0
[0192.151] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.152] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.152] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=77, color=0x19ea80) returned 0x0
[0192.152] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.152] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.152] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=78, color=0x19ea80) returned 0x0
[0192.152] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.152] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.152] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=79, color=0x19ea80) returned 0x0
[0192.152] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.152] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.152] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=80, color=0x19ea80) returned 0x0
[0192.152] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.152] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.152] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=81, color=0x19ea80) returned 0x0
[0192.152] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.152] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.152] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=82, color=0x19ea80) returned 0x0
[0192.153] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.153] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.153] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=83, color=0x19ea80) returned 0x0
[0192.153] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.153] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.153] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=84, color=0x19ea80) returned 0x0
[0192.153] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.153] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.153] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=85, color=0x19ea80) returned 0x0
[0192.153] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.153] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.153] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=86, color=0x19ea80) returned 0x0
[0192.153] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.153] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.153] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=87, color=0x19ea80) returned 0x0
[0192.153] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.153] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.153] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=88, color=0x19ea80) returned 0x0
[0192.153] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.153] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.153] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=89, color=0x19ea80) returned 0x0
[0192.153] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.153] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.153] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=90, color=0x19ea80) returned 0x0
[0192.154] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.154] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.154] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=91, color=0x19ea80) returned 0x0
[0192.154] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.154] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.154] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=92, color=0x19ea80) returned 0x0
[0192.154] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.154] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.154] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=93, color=0x19ea80) returned 0x0
[0192.154] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.154] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.154] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=94, color=0x19ea80) returned 0x0
[0192.154] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.154] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.154] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=95, color=0x19ea80) returned 0x0
[0192.154] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.154] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.154] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=96, color=0x19ea80) returned 0x0
[0192.154] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.154] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.154] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=97, color=0x19ea80) returned 0x0
[0192.154] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.154] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.154] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=98, color=0x19ea80) returned 0x0
[0192.154] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.154] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.155] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=99, color=0x19ea80) returned 0x0
[0192.155] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.155] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.155] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=100, color=0x19ea80) returned 0x0
[0192.155] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.155] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.155] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=101, color=0x19ea80) returned 0x0
[0192.155] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.155] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.155] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=102, color=0x19ea80) returned 0x0
[0192.155] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.155] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.155] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=103, color=0x19ea80) returned 0x0
[0192.155] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.155] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.155] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=104, color=0x19ea80) returned 0x0
[0192.155] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.155] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.155] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=105, color=0x19ea80) returned 0x0
[0192.155] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.155] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.155] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=106, color=0x19ea80) returned 0x0
[0192.155] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.155] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.155] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=107, color=0x19ea80) returned 0x0
[0192.156] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.156] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.156] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=108, color=0x19ea80) returned 0x0
[0192.156] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.156] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.156] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=109, color=0x19ea80) returned 0x0
[0192.156] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.156] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.156] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=110, color=0x19ea80) returned 0x0
[0192.156] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.156] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.156] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=111, color=0x19ea80) returned 0x0
[0192.156] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.156] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.156] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=112, color=0x19ea80) returned 0x0
[0192.156] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.156] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.156] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=113, color=0x19ea80) returned 0x0
[0192.156] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.156] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.156] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=114, color=0x19ea80) returned 0x0
[0192.156] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.156] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.156] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=115, color=0x19ea80) returned 0x0
[0192.156] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.157] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.157] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=116, color=0x19ea80) returned 0x0
[0192.157] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.157] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.157] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=117, color=0x19ea80) returned 0x0
[0192.157] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.157] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.157] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=118, color=0x19ea80) returned 0x0
[0192.157] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.157] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.157] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=119, color=0x19ea80) returned 0x0
[0192.157] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.157] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.157] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=120, color=0x19ea80) returned 0x0
[0192.157] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.157] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.157] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=121, color=0x19ea80) returned 0x0
[0192.157] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.157] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.157] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=122, color=0x19ea80) returned 0x0
[0192.157] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.157] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.157] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=123, color=0x19ea80) returned 0x0
[0192.157] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.157] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.157] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=124, color=0x19ea80) returned 0x0
[0192.158] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.158] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.158] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=125, color=0x19ea80) returned 0x0
[0192.158] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.158] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.158] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=126, color=0x19ea80) returned 0x0
[0192.158] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.158] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.158] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=127, color=0x19ea80) returned 0x0
[0192.158] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.158] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.158] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=128, color=0x19ea80) returned 0x0
[0192.158] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.158] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.158] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=129, color=0x19ea80) returned 0x0
[0192.158] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.158] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.158] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=130, color=0x19ea80) returned 0x0
[0192.158] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.158] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.158] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=131, color=0x19ea80) returned 0x0
[0192.158] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.158] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.158] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=132, color=0x19ea80) returned 0x0
[0192.159] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.159] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.160] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=133, color=0x19ea80) returned 0x0
[0192.160] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.160] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.160] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=134, color=0x19ea80) returned 0x0
[0192.160] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.160] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.160] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=135, color=0x19ea80) returned 0x0
[0192.160] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.160] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.160] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=136, color=0x19ea80) returned 0x0
[0192.160] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.160] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.160] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=137, color=0x19ea80) returned 0x0
[0192.161] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.161] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.161] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=138, color=0x19ea80) returned 0x0
[0192.161] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.161] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.161] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=139, color=0x19ea80) returned 0x0
[0192.161] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.161] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.161] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=140, color=0x19ea80) returned 0x0
[0192.161] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.161] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.161] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=141, color=0x19ea80) returned 0x0
[0192.161] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.161] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.161] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=142, color=0x19ea80) returned 0x0
[0192.161] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.161] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.161] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=143, color=0x19ea80) returned 0x0
[0192.161] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.161] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.161] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=144, color=0x19ea80) returned 0x0
[0192.162] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.162] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.162] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=145, color=0x19ea80) returned 0x0
[0192.162] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.162] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.162] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=146, color=0x19ea80) returned 0x0
[0192.162] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.162] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.162] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=147, color=0x19ea80) returned 0x0
[0192.162] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.162] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.162] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=148, color=0x19ea80) returned 0x0
[0192.162] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.162] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.162] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=149, color=0x19ea80) returned 0x0
[0192.162] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.162] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.162] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=150, color=0x19ea80) returned 0x0
[0192.163] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.163] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.163] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=151, color=0x19ea80) returned 0x0
[0192.163] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.163] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.163] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=152, color=0x19ea80) returned 0x0
[0192.163] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.163] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.163] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=153, color=0x19ea80) returned 0x0
[0192.163] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.163] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.163] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=154, color=0x19ea80) returned 0x0
[0192.163] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.163] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.163] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=155, color=0x19ea80) returned 0x0
[0192.163] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.163] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.163] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=156, color=0x19ea80) returned 0x0
[0192.163] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.164] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.164] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=157, color=0x19ea80) returned 0x0
[0192.164] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.164] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.164] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=158, color=0x19ea80) returned 0x0
[0192.164] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.164] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.164] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=159, color=0x19ea80) returned 0x0
[0192.164] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.164] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.164] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=160, color=0x19ea80) returned 0x0
[0192.164] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.164] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.164] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=161, color=0x19ea80) returned 0x0
[0192.164] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.164] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.164] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=162, color=0x19ea80) returned 0x0
[0192.164] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.164] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.164] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=163, color=0x19ea80) returned 0x0
[0192.165] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.165] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.165] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=164, color=0x19ea80) returned 0x0
[0192.165] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.165] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.165] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=165, color=0x19ea80) returned 0x0
[0192.165] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.165] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.165] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=166, color=0x19ea80) returned 0x0
[0192.165] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.165] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.165] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=167, color=0x19ea80) returned 0x0
[0192.165] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.165] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.165] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=168, color=0x19ea80) returned 0x0
[0192.165] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.165] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.165] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=169, color=0x19ea80) returned 0x0
[0192.165] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.166] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.166] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=170, color=0x19ea80) returned 0x0
[0192.166] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.166] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.166] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=171, color=0x19ea80) returned 0x0
[0192.166] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.166] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.166] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=172, color=0x19ea80) returned 0x0
[0192.166] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.166] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.166] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=173, color=0x19ea80) returned 0x0
[0192.166] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.166] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.166] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=174, color=0x19ea80) returned 0x0
[0192.166] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.166] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.166] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=175, color=0x19ea80) returned 0x0
[0192.166] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.166] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.167] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=176, color=0x19ea80) returned 0x0
[0192.167] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.167] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.167] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=177, color=0x19ea80) returned 0x0
[0192.167] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.167] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.167] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=178, color=0x19ea80) returned 0x0
[0192.167] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.167] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.167] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=179, color=0x19ea80) returned 0x0
[0192.167] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.167] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.167] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=180, color=0x19ea80) returned 0x0
[0192.167] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.167] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.167] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=181, color=0x19ea80) returned 0x0
[0192.167] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.167] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.167] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=182, color=0x19ea80) returned 0x0
[0192.167] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.168] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.168] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=183, color=0x19ea80) returned 0x0
[0192.168] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.168] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.168] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=184, color=0x19ea80) returned 0x0
[0192.168] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.168] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.168] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=185, color=0x19ea80) returned 0x0
[0192.168] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.168] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.168] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=186, color=0x19ea80) returned 0x0
[0192.168] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.168] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.168] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=187, color=0x19ea80) returned 0x0
[0192.168] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.168] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.168] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=188, color=0x19ea80) returned 0x0
[0192.168] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.168] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.168] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=189, color=0x19ea80) returned 0x0
[0192.169] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.169] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.169] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=190, color=0x19ea80) returned 0x0
[0192.169] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.169] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.169] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=191, color=0x19ea80) returned 0x0
[0192.169] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.169] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.169] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=192, color=0x19ea80) returned 0x0
[0192.169] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.169] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.169] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=193, color=0x19ea80) returned 0x0
[0192.169] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.169] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.169] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=194, color=0x19ea80) returned 0x0
[0192.169] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.169] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.169] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=195, color=0x19ea80) returned 0x0
[0192.169] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.169] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.170] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=196, color=0x19ea80) returned 0x0
[0192.170] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.170] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.170] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=197, color=0x19ea80) returned 0x0
[0192.170] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.170] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.170] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=198, color=0x19ea80) returned 0x0
[0192.170] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.170] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.170] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=199, color=0x19ea80) returned 0x0
[0192.170] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.170] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.170] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=200, color=0x19ea80) returned 0x0
[0192.170] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.170] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.171] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=201, color=0x19ea80) returned 0x0
[0192.171] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.171] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.171] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=202, color=0x19ea80) returned 0x0
[0192.171] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.171] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.171] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=203, color=0x19ea80) returned 0x0
[0192.171] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.171] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.171] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=204, color=0x19ea80) returned 0x0
[0192.171] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.171] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.171] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=205, color=0x19ea80) returned 0x0
[0192.171] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.171] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.171] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=206, color=0x19ea80) returned 0x0
[0192.171] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.171] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.171] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=207, color=0x19ea80) returned 0x0
[0192.172] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.172] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.172] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=208, color=0x19ea80) returned 0x0
[0192.172] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.172] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.172] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=209, color=0x19ea80) returned 0x0
[0192.172] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.172] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.172] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=210, color=0x19ea80) returned 0x0
[0192.172] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.172] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.172] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=211, color=0x19ea80) returned 0x0
[0192.172] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.172] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.172] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=212, color=0x19ea80) returned 0x0
[0192.173] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.173] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.173] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=213, color=0x19ea80) returned 0x0
[0192.173] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.173] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.173] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=214, color=0x19ea80) returned 0x0
[0192.173] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.173] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.173] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=215, color=0x19ea80) returned 0x0
[0192.173] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.173] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.173] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=216, color=0x19ea80) returned 0x0
[0192.173] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.173] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.173] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=217, color=0x19ea80) returned 0x0
[0192.173] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.173] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.173] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=218, color=0x19ea80) returned 0x0
[0192.173] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.174] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.174] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=219, color=0x19ea80) returned 0x0
[0192.174] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.174] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.174] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=220, color=0x19ea80) returned 0x0
[0192.174] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.174] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.174] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=221, color=0x19ea80) returned 0x0
[0192.174] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.174] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.174] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=222, color=0x19ea80) returned 0x0
[0192.174] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.174] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.174] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=223, color=0x19ea80) returned 0x0
[0192.174] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.174] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.174] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=224, color=0x19ea80) returned 0x0
[0192.174] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.174] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.174] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=225, color=0x19ea80) returned 0x0
[0192.175] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.175] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.175] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=226, color=0x19ea80) returned 0x0
[0192.175] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.175] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.175] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=227, color=0x19ea80) returned 0x0
[0192.175] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.175] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.175] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=228, color=0x19ea80) returned 0x0
[0192.175] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.175] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.175] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=229, color=0x19ea80) returned 0x0
[0192.175] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.175] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.175] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=230, color=0x19ea80) returned 0x0
[0192.175] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.175] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.175] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=231, color=0x19ea80) returned 0x0
[0192.176] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.176] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.176] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=232, color=0x19ea80) returned 0x0
[0192.176] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.176] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.176] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=233, color=0x19ea80) returned 0x0
[0192.176] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.176] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.176] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=234, color=0x19ea80) returned 0x0
[0192.176] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.176] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.176] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=235, color=0x19ea80) returned 0x0
[0192.176] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.176] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.176] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=236, color=0x19ea80) returned 0x0
[0192.176] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.176] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.176] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=237, color=0x19ea80) returned 0x0
[0192.176] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.176] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.176] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=238, color=0x19ea80) returned 0x0
[0192.177] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.177] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.177] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=239, color=0x19ea80) returned 0x0
[0192.177] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.177] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.177] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=240, color=0x19ea80) returned 0x0
[0192.177] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.177] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.177] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=241, color=0x19ea80) returned 0x0
[0192.177] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.177] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.177] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=242, color=0x19ea80) returned 0x0
[0192.177] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.177] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.177] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=243, color=0x19ea80) returned 0x0
[0192.177] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.177] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.177] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=244, color=0x19ea80) returned 0x0
[0192.178] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.178] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.178] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=245, color=0x19ea80) returned 0x0
[0192.178] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.178] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.179] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=246, color=0x19ea80) returned 0x0
[0192.180] GdipGetImageWidth (image=0x5c9f268, width=0x19ea70) returned 0x0
[0192.180] GdipGetImageHeight (image=0x5c9f268, height=0x19ea70) returned 0x0
[0192.180] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=247, color=0x19ea80) returned 0x0
[0192.180] GdipBitmapGetPixel (bitmap=0x5c9f268, x=0, y=248, color=0x19ea80) returned 0x0
[0192.376] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x77600, lpName=0x0) returned 0x300
[0192.376] memcpy (in: _Dst=0x7b90000, _Src=0x3586060, _Size=0x77600 | out: _Dst=0x7b90000) returned 0x7b90000
[0192.378] CloseHandle (hObject=0x300) returned 1
[0192.781] CoTaskMemAlloc (cb=0xd) returned 0x7a7ae88
[0192.781] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2396fa4, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
[0192.782] LoadLibraryA (lpLibFileName="kernel32") returned 0x76410000
[0192.783] CoTaskMemFree (pv=0x7a7ae88)
[0192.785] CoTaskMemAlloc (cb=0x11) returned 0x4d3670
[0192.785] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResumeThread", cchWideChar=12, lpMultiByteStr=0x23972e0, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResumeThread", lpUsedDefaultChar=0x0) returned 12
[0192.785] GetProcAddress (hModule=0x76410000, lpProcName="ResumeThread") returned 0x7642a800
[0192.785] CoTaskMemFree (pv=0x4d3670)
[0192.789] CoTaskMemAlloc (cb=0xd) returned 0x7a7af60
[0192.789] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2397a64, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
[0192.789] LoadLibraryA (lpLibFileName="kernel32") returned 0x76410000
[0192.790] CoTaskMemFree (pv=0x7a7af60)
[0192.790] CoTaskMemAlloc (cb=0x1a) returned 0x529c10
[0192.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64SetThreadContext", cchWideChar=21, lpMultiByteStr=0x2397a9c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64SetThreadContext", lpUsedDefaultChar=0x0) returned 21
[0192.790] GetProcAddress (hModule=0x76410000, lpProcName="Wow64SetThreadContext") returned 0x76453e60
[0192.790] CoTaskMemFree (pv=0x529c10)
[0192.791] CoTaskMemAlloc (cb=0xd) returned 0x7a7b020
[0192.791] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2397b68, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
[0192.791] LoadLibraryA (lpLibFileName="kernel32") returned 0x76410000
[0192.792] CoTaskMemFree (pv=0x7a7b020)
[0192.792] CoTaskMemAlloc (cb=0x15) returned 0x4d3670
[0192.792] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetThreadContext", cchWideChar=16, lpMultiByteStr=0x2397ba0, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetThreadContext", lpUsedDefaultChar=0x0) returned 16
[0192.792] GetProcAddress (hModule=0x76410000, lpProcName="SetThreadContext") returned 0x76452490
[0192.792] CoTaskMemFree (pv=0x4d3670)
[0192.793] CoTaskMemAlloc (cb=0xd) returned 0x7a7adc8
[0192.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2397c68, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
[0192.793] LoadLibraryA (lpLibFileName="kernel32") returned 0x76410000
[0192.793] CoTaskMemFree (pv=0x7a7adc8)
[0192.793] CoTaskMemAlloc (cb=0x1a) returned 0x529c10
[0192.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Wow64GetThreadContext", cchWideChar=21, lpMultiByteStr=0x2397ca0, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Wow64GetThreadContext", lpUsedDefaultChar=0x0) returned 21
[0192.793] GetProcAddress (hModule=0x76410000, lpProcName="Wow64GetThreadContext") returned 0x76453e30
[0192.793] CoTaskMemFree (pv=0x529c10)
[0192.796] CoTaskMemAlloc (cb=0xd) returned 0x7a7aeb8
[0192.796] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2397d6c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
[0192.796] LoadLibraryA (lpLibFileName="kernel32") returned 0x76410000
[0192.797] CoTaskMemFree (pv=0x7a7aeb8)
[0192.797] CoTaskMemAlloc (cb=0x15) returned 0x4d3670
[0192.797] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetThreadContext", cchWideChar=16, lpMultiByteStr=0x2397da4, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetThreadContext", lpUsedDefaultChar=0x0) returned 16
[0192.797] GetProcAddress (hModule=0x76410000, lpProcName="GetThreadContext") returned 0x7642ec60
[0192.797] CoTaskMemFree (pv=0x4d3670)
[0192.798] CoTaskMemAlloc (cb=0xd) returned 0x7a7adf8
[0192.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2397e60, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
[0192.798] LoadLibraryA (lpLibFileName="kernel32") returned 0x76410000
[0192.798] CoTaskMemFree (pv=0x7a7adf8)
[0192.798] CoTaskMemAlloc (cb=0x13) returned 0x4d33d0
[0192.798] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VirtualAllocEx", cchWideChar=14, lpMultiByteStr=0x2397e98, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VirtualAllocEx", lpUsedDefaultChar=0x0) returned 14
[0192.798] GetProcAddress (hModule=0x76410000, lpProcName="VirtualAllocEx") returned 0x76452730
[0192.798] CoTaskMemFree (pv=0x4d33d0)
[0192.799] CoTaskMemAlloc (cb=0xd) returned 0x7a7b080
[0192.799] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2397f54, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
[0192.799] LoadLibraryA (lpLibFileName="kernel32") returned 0x76410000
[0192.800] CoTaskMemFree (pv=0x7a7b080)
[0192.800] CoTaskMemAlloc (cb=0x17) returned 0x4d3670
[0192.800] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WriteProcessMemory", cchWideChar=18, lpMultiByteStr=0x2397f8c, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WriteProcessMemory", lpUsedDefaultChar=0x0) returned 18
[0192.800] GetProcAddress (hModule=0x76410000, lpProcName="WriteProcessMemory") returned 0x76452850
[0192.800] CoTaskMemFree (pv=0x4d3670)
[0192.801] CoTaskMemAlloc (cb=0xd) returned 0x7a7ae58
[0192.801] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x2398050, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
[0192.801] LoadLibraryA (lpLibFileName="kernel32") returned 0x76410000
[0192.802] CoTaskMemFree (pv=0x7a7ae58)
[0192.802] CoTaskMemAlloc (cb=0x16) returned 0x4d3470
[0192.802] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ReadProcessMemory", cchWideChar=17, lpMultiByteStr=0x2398088, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ReadProcessMemory", lpUsedDefaultChar=0x0) returned 17
[0192.802] GetProcAddress (hModule=0x76410000, lpProcName="ReadProcessMemory") returned 0x76451c80
[0192.802] CoTaskMemFree (pv=0x4d3470)
[0192.803] CoTaskMemAlloc (cb=0xa) returned 0x7a7b080
[0192.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ntdll", cchWideChar=5, lpMultiByteStr=0x2398148, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ntdll", lpUsedDefaultChar=0x0) returned 5
[0192.803] LoadLibraryA (lpLibFileName="ntdll") returned 0x77460000
[0192.803] CoTaskMemFree (pv=0x7a7b080)
[0192.803] CoTaskMemAlloc (cb=0x19) returned 0x529b70
[0192.803] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ZwUnmapViewOfSection", cchWideChar=20, lpMultiByteStr=0x2398174, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ZwUnmapViewOfSection", lpUsedDefaultChar=0x0) returned 20
[0192.804] GetProcAddress (hModule=0x77460000, lpProcName="ZwUnmapViewOfSection") returned 0x774d6f40
[0192.804] CoTaskMemFree (pv=0x529b70)
[0192.805] CoTaskMemAlloc (cb=0xd) returned 0x7a7af90
[0192.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="kernel32", cchWideChar=8, lpMultiByteStr=0x239823c, cbMultiByte=9, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="kernel32", lpUsedDefaultChar=0x0) returned 8
[0192.805] LoadLibraryA (lpLibFileName="kernel32") returned 0x76410000
[0192.805] CoTaskMemFree (pv=0x7a7af90)
[0192.805] CoTaskMemAlloc (cb=0x13) returned 0x4d3670
[0192.805] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateProcessA", cchWideChar=14, lpMultiByteStr=0x2398274, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateProcessA", lpUsedDefaultChar=0x0) returned 14
[0192.805] GetProcAddress (hModule=0x76410000, lpProcName="CreateProcessA") returned 0x76450750
[0192.805] CoTaskMemFree (pv=0x4d3670)
[0192.817] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe", nBufferLength=0x105, lpBuffer=0x19e0e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe", lpFilePart=0x0) returned 0x62
[0192.821] OpenMutexW (dwDesiredAccess=0x100001, bInheritHandle=0, lpName="btLgVXXoNVGzXvelqauFUkXSa") returned 0x0
[0192.841] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="btLgVXXoNVGzXvelqauFUkXSa") returned 0x300
[0198.146] CoTaskMemAlloc (cb=0x20c) returned 0x532520
[0198.146] SHGetFolderPathW (in: hwnd=0x0, csidl=26, hToken=0x0, dwFlags=0x0, pszPath=0x532520 | out: pszPath="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming") returned 0x0
[0198.152] CoTaskMemFree (pv=0x532520)
[0198.152] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", nBufferLength=0x105, lpBuffer=0x19e0d8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming", lpFilePart=0x0) returned 0x25
[0198.176] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", nBufferLength=0x105, lpBuffer=0x19e15c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", lpFilePart=0x0) returned 0x36
[0198.176] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e5bc) returned 1
[0198.176] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\lyfhoewabqlg.exe"), fInfoLevelId=0x0, lpFileInformation=0x19e638 | out: lpFileInformation=0x19e638*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0198.176] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e5b8) returned 1
[0198.183] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", nBufferLength=0x105, lpBuffer=0x19e118, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", lpFilePart=0x0) returned 0x36
[0198.240] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", nBufferLength=0x105, lpBuffer=0x19e11c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", lpFilePart=0x0) returned 0x36
[0198.303] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", nBufferLength=0x105, lpBuffer=0x19e060, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", lpFilePart=0x0) returned 0x36
[0198.322] SetNamedSecurityInfoW () returned 0x2
[0198.768] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe", nBufferLength=0x105, lpBuffer=0x19e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe", lpFilePart=0x0) returned 0x62
[0198.768] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", nBufferLength=0x105, lpBuffer=0x19e114, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", lpFilePart=0x0) returned 0x36
[0198.769] CopyFileW (lpExistingFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe"), lpNewFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\lyfhoewabqlg.exe"), bFailIfExists=1) returned 1
[0200.038] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", nBufferLength=0x105, lpBuffer=0x19e0dc, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", lpFilePart=0x0) returned 0x36
[0200.043] GetUserNameW (in: lpBuffer=0x19e378, pcbBuffer=0x19e5f0 | out: lpBuffer="RDhJ0CNFevzX", pcbBuffer=0x19e5f0) returned 1
[0200.065] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", nBufferLength=0x105, lpBuffer=0x19e04c, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", lpFilePart=0x0) returned 0x36
[0200.066] SetFileAttributesW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", dwFileAttributes=0x2007) returned 1
[0200.081] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e400, DesiredAccess=0x800, PolicyHandle=0x19e3c0 | out: PolicyHandle=0x19e3c0) returned 0x0
[0200.083] CoTaskMemAlloc (cb=0x8) returned 0x532078
[0200.083] CoTaskMemAlloc (cb=0x1a) returned 0x53f0c8
[0200.084] LsaLookupNames2 (in: PolicyHandle=0x565ff0, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e3d4, Sids=0x19e3c8 | out: ReferencedDomains=0x19e3d4, Sids=0x19e3c8) returned 0x0
[0200.088] CoTaskMemFree (pv=0x53f0c8)
[0200.088] CoTaskMemFree (pv=0x532078)
[0200.099] LsaClose (ObjectHandle=0x565ff0) returned 0x0
[0200.099] LsaFreeMemory (Buffer=0x4ec058) returned 0x0
[0200.099] LsaFreeMemory (Buffer=0x53c9b8) returned 0x0
[0200.099] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e400, DesiredAccess=0x800, PolicyHandle=0x19e3c0 | out: PolicyHandle=0x19e3c0) returned 0x0
[0200.100] CoTaskMemAlloc (cb=0x8) returned 0x532018
[0200.100] CoTaskMemAlloc (cb=0x1a) returned 0x53f370
[0200.100] LsaLookupNames2 (in: PolicyHandle=0x566230, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e3d4, Sids=0x19e3c8 | out: ReferencedDomains=0x19e3d4, Sids=0x19e3c8) returned 0x0
[0200.100] CoTaskMemFree (pv=0x53f370)
[0200.100] CoTaskMemFree (pv=0x532018)
[0200.101] LsaClose (ObjectHandle=0x566230) returned 0x0
[0200.101] LsaFreeMemory (Buffer=0x4ec058) returned 0x0
[0200.101] LsaFreeMemory (Buffer=0x53ce30) returned 0x0
[0200.104] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e400, DesiredAccess=0x800, PolicyHandle=0x19e3c0 | out: PolicyHandle=0x19e3c0) returned 0x0
[0200.104] CoTaskMemAlloc (cb=0x8) returned 0x5320a8
[0200.104] CoTaskMemAlloc (cb=0x1a) returned 0x53f370
[0200.104] LsaLookupNames2 (in: PolicyHandle=0x566570, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e3d4, Sids=0x19e3c8 | out: ReferencedDomains=0x19e3d4, Sids=0x19e3c8) returned 0x0
[0200.105] CoTaskMemFree (pv=0x53f370)
[0200.105] CoTaskMemFree (pv=0x5320a8)
[0200.105] LsaClose (ObjectHandle=0x566570) returned 0x0
[0200.105] LsaFreeMemory (Buffer=0x4ec058) returned 0x0
[0200.105] LsaFreeMemory (Buffer=0x53d098) returned 0x0
[0200.105] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e400, DesiredAccess=0x800, PolicyHandle=0x19e3c0 | out: PolicyHandle=0x19e3c0) returned 0x0
[0200.106] CoTaskMemAlloc (cb=0x8) returned 0x531f68
[0200.106] CoTaskMemAlloc (cb=0x1a) returned 0x53efb0
[0200.106] LsaLookupNames2 (in: PolicyHandle=0x566390, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e3d4, Sids=0x19e3c8 | out: ReferencedDomains=0x19e3d4, Sids=0x19e3c8) returned 0x0
[0200.106] CoTaskMemFree (pv=0x53efb0)
[0200.107] CoTaskMemFree (pv=0x531f68)
[0200.107] LsaClose (ObjectHandle=0x566390) returned 0x0
[0200.107] LsaFreeMemory (Buffer=0x4ec058) returned 0x0
[0200.107] LsaFreeMemory (Buffer=0x53d300) returned 0x0
[0200.108] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e400, DesiredAccess=0x800, PolicyHandle=0x19e3c0 | out: PolicyHandle=0x19e3c0) returned 0x0
[0200.109] CoTaskMemAlloc (cb=0x8) returned 0x5320a8
[0200.109] CoTaskMemAlloc (cb=0x1a) returned 0x53f118
[0200.109] LsaLookupNames2 (in: PolicyHandle=0x566350, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e3d4, Sids=0x19e3c8 | out: ReferencedDomains=0x19e3d4, Sids=0x19e3c8) returned 0x0
[0200.109] CoTaskMemFree (pv=0x53f118)
[0200.109] CoTaskMemFree (pv=0x5320a8)
[0200.110] LsaClose (ObjectHandle=0x566350) returned 0x0
[0200.110] LsaFreeMemory (Buffer=0x4ec058) returned 0x0
[0200.110] LsaFreeMemory (Buffer=0x53cc78) returned 0x0
[0200.110] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e400, DesiredAccess=0x800, PolicyHandle=0x19e3c0 | out: PolicyHandle=0x19e3c0) returned 0x0
[0200.110] CoTaskMemAlloc (cb=0x8) returned 0x532078
[0200.110] CoTaskMemAlloc (cb=0x1a) returned 0x53f118
[0200.110] LsaLookupNames2 (in: PolicyHandle=0x5662f0, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e3d4, Sids=0x19e3c8 | out: ReferencedDomains=0x19e3d4, Sids=0x19e3c8) returned 0x0
[0200.111] CoTaskMemFree (pv=0x53f118)
[0200.111] CoTaskMemFree (pv=0x532078)
[0200.111] LsaClose (ObjectHandle=0x5662f0) returned 0x0
[0200.111] LsaFreeMemory (Buffer=0x4ec058) returned 0x0
[0200.111] LsaFreeMemory (Buffer=0x53ca10) returned 0x0
[0200.111] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e400, DesiredAccess=0x800, PolicyHandle=0x19e3c0 | out: PolicyHandle=0x19e3c0) returned 0x0
[0200.112] CoTaskMemAlloc (cb=0x8) returned 0x531fd8
[0200.112] CoTaskMemAlloc (cb=0x1a) returned 0x53f208
[0200.112] LsaLookupNames2 (in: PolicyHandle=0x5666f0, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e3d4, Sids=0x19e3c8 | out: ReferencedDomains=0x19e3d4, Sids=0x19e3c8) returned 0x0
[0200.112] CoTaskMemFree (pv=0x53f208)
[0200.112] CoTaskMemFree (pv=0x531fd8)
[0200.112] LsaClose (ObjectHandle=0x5666f0) returned 0x0
[0200.113] LsaFreeMemory (Buffer=0x4ec058) returned 0x0
[0200.113] LsaFreeMemory (Buffer=0x53d358) returned 0x0
[0200.113] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e400, DesiredAccess=0x800, PolicyHandle=0x19e3c0 | out: PolicyHandle=0x19e3c0) returned 0x0
[0200.113] CoTaskMemAlloc (cb=0x8) returned 0x532088
[0200.113] CoTaskMemAlloc (cb=0x1a) returned 0x53f190
[0200.113] LsaLookupNames2 (in: PolicyHandle=0x5660f0, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e3d4, Sids=0x19e3c8 | out: ReferencedDomains=0x19e3d4, Sids=0x19e3c8) returned 0x0
[0200.114] CoTaskMemFree (pv=0x53f190)
[0200.114] CoTaskMemFree (pv=0x532088)
[0200.114] LsaClose (ObjectHandle=0x5660f0) returned 0x0
[0200.114] LsaFreeMemory (Buffer=0x4ec128) returned 0x0
[0200.114] LsaFreeMemory (Buffer=0x53d098) returned 0x0
[0200.114] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e400, DesiredAccess=0x800, PolicyHandle=0x19e3c0 | out: PolicyHandle=0x19e3c0) returned 0x0
[0200.114] CoTaskMemAlloc (cb=0x8) returned 0x532028
[0200.114] CoTaskMemAlloc (cb=0x1a) returned 0x53f2d0
[0200.115] LsaLookupNames2 (in: PolicyHandle=0x5663d0, Flags=0x0, Count=0x1, Names="RDhJ0CNFevzX", ReferencedDomains=0x19e3d4, Sids=0x19e3c8 | out: ReferencedDomains=0x19e3d4, Sids=0x19e3c8) returned 0x0
[0200.115] CoTaskMemFree (pv=0x53f2d0)
[0200.115] CoTaskMemFree (pv=0x532028)
[0200.115] LsaClose (ObjectHandle=0x5663d0) returned 0x0
[0200.115] LsaFreeMemory (Buffer=0x4ec058) returned 0x0
[0200.116] LsaFreeMemory (Buffer=0x53d358) returned 0x0
[0200.116] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", nBufferLength=0x105, lpBuffer=0x19e0e0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", lpFilePart=0x0) returned 0x36
[0200.116] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", nBufferLength=0x105, lpBuffer=0x19e024, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe", lpFilePart=0x0) returned 0x36
[0200.116] SetNamedSecurityInfoW () returned 0x0
[0200.181] GetCurrentProcess () returned 0xffffffff
[0200.181] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e4f0 | out: TokenHandle=0x19e4f0*=0x3d8) returned 1
[0200.187] GetTokenInformation (in: TokenHandle=0x3d8, TokenInformationClass=0x8, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19e4e8 | out: TokenInformation=0x0, ReturnLength=0x19e4e8) returned 0
[0200.215] LocalAlloc (uFlags=0x0, uBytes=0x4) returned 0x531fb8
[0200.215] GetTokenInformation (in: TokenHandle=0x3d8, TokenInformationClass=0x8, TokenInformation=0x531fb8, TokenInformationLength=0x4, ReturnLength=0x19e4e8 | out: TokenInformation=0x531fb8, ReturnLength=0x19e4e8) returned 1
[0200.215] LocalFree (hMem=0x531fb8) returned 0x0
[0200.215] DuplicateTokenEx (in: hExistingToken=0x3d8, dwDesiredAccess=0x8, lpTokenAttributes=0x0, ImpersonationLevel=0x2, TokenType=0x2, phNewToken=0x19e4f0 | out: phNewToken=0x19e4f0*=0x3dc) returned 1
[0200.216] CheckTokenMembership (in: TokenHandle=0x3dc, SidToCheck=0x240d144*(Revision=0x1, SubAuthorityCount=0x2, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x20, [1]=0x0)), IsMember=0x19e500 | out: IsMember=0x19e500) returned 1
[0200.216] CloseHandle (hObject=0x3dc) returned 1
[0200.721] LocalAlloc (uFlags=0x0, uBytes=0x16) returned 0x567198
[0200.721] LocalAlloc (uFlags=0x0, uBytes=0xb2) returned 0x5429a0
[0200.721] ShellExecuteExW (in: pExecInfo=0x243e230*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="powershell", lpParameters="Add-MpPreference -ExclusionPath \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x243e230*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="powershell", lpParameters="Add-MpPreference -ExclusionPath \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x518)) returned 1
[0203.770] LocalFree (hMem=0x567198) returned 0x0
[0203.771] LocalFree (hMem=0x5429a0) returned 0x0
[0203.772] GetCurrentProcess () returned 0xffffffff
[0203.772] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e55c | out: TokenHandle=0x19e55c*=0x3e4) returned 1
[0203.775] GetCurrentProcess () returned 0xffffffff
[0203.775] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e52c | out: TokenHandle=0x19e52c*=0x49c) returned 1
[0203.776] GetTokenInformation (in: TokenHandle=0x3e4, TokenInformationClass=0x1, TokenInformation=0x0, TokenInformationLength=0x0, ReturnLength=0x19e560 | out: TokenInformation=0x0, ReturnLength=0x19e560) returned 0
[0203.776] LocalAlloc (uFlags=0x0, uBytes=0x24) returned 0x7ab3638
[0203.776] GetTokenInformation (in: TokenHandle=0x3e4, TokenInformationClass=0x1, TokenInformation=0x7ab3638, TokenInformationLength=0x24, ReturnLength=0x19e560 | out: TokenInformation=0x7ab3638, ReturnLength=0x19e560) returned 1
[0203.777] LocalFree (hMem=0x7ab3638) returned 0x0
[0203.777] LsaOpenPolicy (in: SystemName=0x0, ObjectAttributes=0x19e480, DesiredAccess=0x800, PolicyHandle=0x19e440 | out: PolicyHandle=0x19e440) returned 0x0
[0203.778] LsaLookupSids (in: PolicyHandle=0x566f00, Count=0x1, Sids=0x2468860*=0x2468804*(Revision=0x1, SubAuthorityCount=0x5, IdentifierAuthority.Value=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x5), SubAuthority=([0]=0x15, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x65)), ReferencedDomains=0x19e45c, Names=0x19e450 | out: ReferencedDomains=0x19e45c, Names=0x19e450) returned 0x0
[0203.779] LsaClose (ObjectHandle=0x566f00) returned 0x0
[0203.779] LsaFreeMemory (Buffer=0x7a96688) returned 0x0
[0203.779] LsaFreeMemory (Buffer=0x7aba108) returned 0x0
[0203.780] CoTaskMemAlloc (cb=0x20c) returned 0x7ab49e0
[0203.780] GetTempPathW (in: nBufferLength=0x104, lpBuffer=0x7ab49e0 | out: lpBuffer="C:\\Users\\RDHJ0C~1\\AppData\\Local\\Temp\\") returned 0x25
[0203.780] CoTaskMemFree (pv=0x7ab49e0)
[0203.780] GetLongPathNameW (in: lpszShortPath="C:\\Users\\RDHJ0C~1\\", lpszLongPath=0x19e09c, cchBuffer=0x104 | out: lpszLongPath="C:\\Users\\RDhJ0CNFevzX\\") returned 0x16
[0203.781] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x19e0b0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x29
[0203.782] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", nBufferLength=0x105, lpBuffer=0x19e038, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpFilePart=0x0) returned 0x29
[0203.782] CoTaskMemAlloc (cb=0x20c) returned 0x7ab49e0
[0203.782] GetTempFileNameW (in: lpPathName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\", lpPrefixString="tmp", uUnique=0x0, lpTempFileName=0x7ab49e0 | out: lpTempFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\tmp5e17.tmp")) returned 0x5e17
[0203.784] CoTaskMemFree (pv=0x7ab49e0)
[0203.836] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp", nBufferLength=0x105, lpBuffer=0x19df54, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp", lpFilePart=0x0) returned 0x34
[0203.836] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e448) returned 1
[0203.836] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\tmp5e17.tmp"), dwDesiredAccess=0x40000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x8100000, hTemplateFile=0x0) returned 0x3e0
[0203.837] GetFileType (hFile=0x3e0) returned 0x1
[0203.837] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e444) returned 1
[0203.837] GetFileType (hFile=0x3e0) returned 0x1
[0203.844] WriteFile (in: hFile=0x3e0, lpBuffer=0x246cf64*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x19e4e0, lpOverlapped=0x0 | out: lpBuffer=0x246cf64*, lpNumberOfBytesWritten=0x19e4e0*=0x640, lpOverlapped=0x0) returned 1
[0203.846] CloseHandle (hObject=0x3e0) returned 1
[0203.855] LocalAlloc (uFlags=0x0, uBytes=0x1a) returned 0x7aab998
[0203.855] LocalAlloc (uFlags=0x0, uBytes=0xbe) returned 0x563c98
[0203.855] ShellExecuteExW (in: pExecInfo=0x246e810*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="schtasks.exe", lpParameters="/Create /TN \"Updates\\lyfhOEwABQlG\" /XML \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp\"", lpDirectory=0x0, nShow=0, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x246e810*(cbSize=0x3c, fMask=0x540, hwnd=0x0, lpVerb=0x0, lpFile="schtasks.exe", lpParameters="/Create /TN \"Updates\\lyfhOEwABQlG\" /XML \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp\"", lpDirectory=0x0, nShow=0, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x504)) returned 1
[0209.264] LocalFree (hMem=0x7aab998) returned 0x0
[0209.265] LocalFree (hMem=0x563c98) returned 0x0
[0209.268] GetCurrentProcess () returned 0xffffffff
[0209.268] GetCurrentProcess () returned 0xffffffff
[0209.269] DuplicateHandle (in: hSourceProcessHandle=0xffffffff, hSourceHandle=0x504, hTargetProcessHandle=0xffffffff, lpTargetHandle=0x19e544, dwDesiredAccess=0x0, bInheritHandle=0, dwOptions=0x2 | out: lpTargetHandle=0x19e544*=0x3dc) returned 1
[0209.270] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19e53c*=0x3dc, lpdwindex=0x19e35c | out: lpdwindex=0x19e35c) returned 0x0
[0223.008] CloseHandle (hObject=0x3dc) returned 1
[0223.008] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp", nBufferLength=0x105, lpBuffer=0x19e0c4, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp", lpFilePart=0x0) returned 0x34
[0223.010] DeleteFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\tmp5e17.tmp")) returned 1
[0223.585] CreateFileMappingW (hFile=0xffffffff, lpFileMappingAttributes=0x0, flProtect=0x4, dwMaximumSizeHigh=0x0, dwMaximumSizeLow=0x36400, lpName=0x0) returned 0x3e4
[0223.586] memcpy (in: _Dst=0x7c50000, _Src=0x345f678, _Size=0x36400 | out: _Dst=0x7c50000) returned 0x7c50000
[0223.590] CloseHandle (hObject=0x3e4) returned 1
[0223.721] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe", nBufferLength=0x105, lpBuffer=0x19e020, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe", lpFilePart=0x0) returned 0x62
[0223.728] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19dab0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e
[0223.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe", cchWideChar=98, lpMultiByteStr=0x19e2a4, cbMultiByte=100, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exeÎ\x07\x8e/\x93R «þk|ê\x19", lpUsedDefaultChar=0x0) returned 98
[0223.793] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="", cchWideChar=0, lpMultiByteStr=0x19e2a0, cbMultiByte=2, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="4~Î\x07C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe", lpUsedDefaultChar=0x0) returned 0
[0223.794] CreateProcessA (in: lpApplicationName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe", lpCommandLine="", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x8000004, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x19e364*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x19e608 | out: lpCommandLine="", lpProcessInformation=0x19e608*(hProcess=0x504, hThread=0x3e4, dwProcessId=0x13ac, dwThreadId=0x704)) returned 1
[0223.905] CoTaskMemFree (pv=0x0)
[0223.913] GetThreadContext (in: hThread=0x3e4, lpContext=0x2406a54 | out: lpContext=0x2406a54*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x3dc000, Edx=0x0, Ecx=0x0, Eax=0x48405a, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1
[0223.915] ReadProcessMemory (in: hProcess=0x504, lpBaseAddress=0x3dc008, lpBuffer=0x19e5f8, nSize=0x4, lpNumberOfBytesRead=0x19e63c | out: lpBuffer=0x19e5f8*, lpNumberOfBytesRead=0x19e63c*=0x4) returned 1
[0223.915] NtUnmapViewOfSection (ProcessHandle=0x504, BaseAddress=0x400000) returned 0x0
[0223.923] VirtualAllocEx (hProcess=0x504, lpAddress=0x400000, dwSize=0x3a000, flAllocationType=0x3000, flProtect=0x40) returned 0x400000
[0223.925] WriteProcessMemory (in: hProcess=0x504, lpBaseAddress=0x400000, lpBuffer=0x34ca0b8*, nSize=0x200, lpNumberOfBytesWritten=0x19e63c | out: lpBuffer=0x34ca0b8*, lpNumberOfBytesWritten=0x19e63c*=0x200) returned 1
[0223.988] WriteProcessMemory (in: hProcess=0x504, lpBaseAddress=0x402000, lpBuffer=0x34fe6d8*, nSize=0x33c00, lpNumberOfBytesWritten=0x19e63c | out: lpBuffer=0x34fe6d8*, lpNumberOfBytesWritten=0x19e63c*=0x33c00) returned 1
[0224.845] WriteProcessMemory (in: hProcess=0x504, lpBaseAddress=0x436000, lpBuffer=0x2432548*, nSize=0x600, lpNumberOfBytesWritten=0x19e63c | out: lpBuffer=0x2432548*, lpNumberOfBytesWritten=0x19e63c*=0x600) returned 1
[0225.064] WriteProcessMemory (in: hProcess=0x504, lpBaseAddress=0x438000, lpBuffer=0x2432b54*, nSize=0x200, lpNumberOfBytesWritten=0x19e63c | out: lpBuffer=0x2432b54*, lpNumberOfBytesWritten=0x19e63c*=0x200) returned 1
[0225.236] WriteProcessMemory (in: hProcess=0x504, lpBaseAddress=0x3dc008, lpBuffer=0x2433060*, nSize=0x4, lpNumberOfBytesWritten=0x19e63c | out: lpBuffer=0x2433060*, lpNumberOfBytesWritten=0x19e63c*=0x4) returned 1
[0225.283] SetThreadContext (hThread=0x3e4, lpContext=0x2406a54*(ContextFlags=0x10002, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x0, FloatSave.StatusWord=0x0, FloatSave.TagWord=0x0, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x0, SegFs=0x0, SegEs=0x0, SegDs=0x0, Edi=0x0, Esi=0x0, Ebx=0x3dc000, Edx=0x0, Ecx=0x0, Eax=0x435b1e, Ebp=0x0, Eip=0x0, SegCs=0x0, EFlags=0x0, Esp=0x0, SegSs=0x0, ExtendedRegisters=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1
[0225.284] ResumeThread (hThread=0x3e4) returned 0x1
[0225.403] CoGetContextToken (in: pToken=0x19e9e8 | out: pToken=0x19e9e8) returned 0x0
[0225.403] CObjectContext::QueryInterface () returned 0x0
[0225.403] CObjectContext::GetCurrentThreadType () returned 0x0
[0225.403] Release () returned 0x3
[0225.405] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0x13880, cHandles=0x1, pHandles=0x4a84e8*=0x14c, lpdwindex=0x19e88c | out: lpdwindex=0x19e88c) returned 0x0
Thread:
id = 2
os_tid = 0xad4
Thread:
id = 3
os_tid = 0x7a0
Thread:
id = 4
os_tid = 0xb64
[0134.348] CoGetContextToken (in: pToken=0x22dfc3c | out: pToken=0x22dfc3c) returned 0x800401f0
[0134.348] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0134.348] RoInitialize () returned 0x1
[0134.348] RoUninitialize () returned 0x0
[0220.478] CloseHandle (hObject=0x49c) returned 1
[0220.479] CloseHandle (hObject=0x3d8) returned 1
[0220.479] CloseHandle (hObject=0x518) returned 1
[0223.515] CloseHandle (hObject=0x504) returned 1
[0223.516] CloseHandle (hObject=0x3e4) returned 1
[0225.467] SetWindowLongW (hWnd=0x801ec, nIndex=-4, dwNewLong=1947273184) returned 77202918
[0225.469] SetClassLongW (hWnd=0x801ec, nIndex=-24, dwNewLong=1947273184) returned 0x49a05be
[0225.470] PostMessageW (hWnd=0x801ec, Msg=0x10, wParam=0x0, lParam=0x0) returned 1
[0225.470] GetModuleHandleW (lpModuleName=0x0) returned 0x400000
[0225.471] UnregisterClassW (lpClassName="WindowsForms10.Window.8.app.0.141b42a_r10_ad1", hInstance=0x400000) returned 0
[0225.476] IsWindow (hWnd=0x50342) returned 1
[0225.481] GetModuleHandleW (lpModuleName="user32.dll") returned 0x755e0000
[0225.482] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x400, lpWideCharStr="DefWindowProcW", cchWideChar=14, lpMultiByteStr=0x22df9dc, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DefWindowProcW`j\x8e/\x93R «þkXü-\x028yL", lpUsedDefaultChar=0x0) returned 14
[0225.482] GetProcAddress (hModule=0x755e0000, lpProcName="DefWindowProcW") returned 0x741107e0
[0225.482] SetWindowLongW (hWnd=0x50342, nIndex=-4, dwNewLong=1947273184) returned 77202998
[0225.482] SetClassLongW (hWnd=0x50342, nIndex=-24, dwNewLong=1947273184) returned 0x49a0636
[0225.483] IsWindow (hWnd=0x50342) returned 1
[0225.483] DestroyWindow (hWnd=0x50342) returned 0
[0225.483] PostMessageW (hWnd=0x50342, Msg=0x10, wParam=0x0, lParam=0x0) returned 1
[0225.483] SetConsoleCtrlHandler (HandlerRoutine=0x49a060e, Add=0) returned 1
[0225.484] EtwEventUnregister (RegHandle=0x4da320) returned 0x0
[0225.530] CloseHandle (hObject=0x270) returned 1
[0225.532] GdipDeleteFont (font=0x4b8efc0) returned 0x0
[0225.534] GdipDisposeImage (image=0x5c9f268) returned 0x0
[0225.540] GdipDeleteFont (font=0x4b81f08) returned 0x0
[0225.541] DeleteObject (ho=0x520a083c) returned 1
[0225.542] RestoreDC (hdc=0x330106d7, nSavedDC=-1) returned 1
[0225.543] DeleteDC (hdc=0x330106d7) returned 1
[0225.544] DeleteObject (ho=0x8d0a095f) returned 1
[0225.544] DeleteObject (ho=0x160a096d) returned 1
[0225.553] CloseHandle (hObject=0x300) returned 1
[0225.554] RegCloseKey (hKey=0x80000004) returned 0x0
Thread:
id = 5
os_tid = 0x5d8
Thread:
id = 6
os_tid = 0x410
Thread:
id = 7
os_tid = 0x1154
Thread:
id = 8
os_tid = 0x384
Thread:
id = 9
os_tid = 0xe68
[0192.870] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0192.870] RoInitialize () returned 0x1
[0192.870] RoUninitialize () returned 0x0
[0192.909] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x7def1ec | out: lpLuid=0x7def1ec*(LowPart=0x14, HighPart=0)) returned 1
[0192.911] GetCurrentProcess () returned 0xffffffff
[0192.911] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x7def1e8 | out: TokenHandle=0x7def1e8*=0x324) returned 1
[0192.912] AdjustTokenPrivileges (in: TokenHandle=0x324, DisableAllPrivileges=0, NewState=0x23a5408*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
[0192.912] CloseHandle (hObject=0x324) returned 1
[0195.758] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35fd680, Length=0x20000, ResultLength=0x7def8c8 | out: SystemInformation=0x35fd680, ResultLength=0x7def8c8*=0x17630) returned 0x0
[0198.123] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35fd680, Length=0x20000, ResultLength=0x7def8c8 | out: SystemInformation=0x35fd680, ResultLength=0x7def8c8*=0x175f0) returned 0x0
[0200.190] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35fd680, Length=0x20000, ResultLength=0x7def8c8 | out: SystemInformation=0x35fd680, ResultLength=0x7def8c8*=0x17670) returned 0x0
[0202.861] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35fd680, Length=0x20000, ResultLength=0x7def8c8 | out: SystemInformation=0x35fd680, ResultLength=0x7def8c8*=0x17730) returned 0x0
[0205.452] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35fd680, Length=0x20000, ResultLength=0x7def8c8 | out: SystemInformation=0x35fd680, ResultLength=0x7def8c8*=0x17c28) returned 0x0
[0208.519] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35fd680, Length=0x20000, ResultLength=0x7def8c8 | out: SystemInformation=0x35fd680, ResultLength=0x7def8c8*=0x17c28) returned 0x0
[0213.921] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35fd680, Length=0x20000, ResultLength=0x7def8c8 | out: SystemInformation=0x35fd680, ResultLength=0x7def8c8*=0x17da0) returned 0x0
[0216.007] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35fd680, Length=0x20000, ResultLength=0x7def8c8 | out: SystemInformation=0x35fd680, ResultLength=0x7def8c8*=0x17d20) returned 0x0
[0218.205] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35fd680, Length=0x20000, ResultLength=0x7def8c8 | out: SystemInformation=0x35fd680, ResultLength=0x7def8c8*=0x17d20) returned 0x0
[0220.441] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35fd680, Length=0x20000, ResultLength=0x7def8c8 | out: SystemInformation=0x35fd680, ResultLength=0x7def8c8*=0x17d20) returned 0x0
[0222.507] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35fd680, Length=0x20000, ResultLength=0x7def8c8 | out: SystemInformation=0x35fd680, ResultLength=0x7def8c8*=0x17da0) returned 0x0
[0224.677] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35fd680, Length=0x20000, ResultLength=0x7def8c8 | out: SystemInformation=0x35fd680, ResultLength=0x7def8c8*=0x17b98) returned 0x0
Thread:
id = 10
os_tid = 0x6bc
Thread:
id = 11
os_tid = 0x3b8
Thread:
id = 12
os_tid = 0xfd0
Thread:
id = 13
os_tid = 0x650
Thread:
id = 112
os_tid = 0x10a0
[0225.376] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0225.376] RoInitialize () returned 0x1
[0225.376] RoUninitialize () returned 0x0
[0225.376] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x35fd680, Length=0x20000, ResultLength=0x89cf848 | out: SystemInformation=0x35fd680, ResultLength=0x89cf848*=0x17c58) returned 0x0
Thread:
id = 113
os_tid = 0x10a4
Process:
id = "2"
image_name = "powershell.exe"
filename = "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe"
page_root = "0x72403000"
os_pid = "0x9c8"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "1"
os_parent_pid = "0x6d8"
cmd_line = "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" Add-MpPreference -ExclusionPath \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe\""
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f600" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 678
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 679
start_va = 0x30000
end_va = 0x31fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 680
start_va = 0x40000
end_va = 0x54fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 681
start_va = 0x60000
end_va = 0x9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000060000"
filename = ""
Region:
id = 682
start_va = 0xa0000
end_va = 0xdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000a0000"
filename = ""
Region:
id = 683
start_va = 0xe0000
end_va = 0xe3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 684
start_va = 0xf0000
end_va = 0xf0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000f0000"
filename = ""
Region:
id = 685
start_va = 0x100000
end_va = 0x101fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000100000"
filename = ""
Region:
id = 686
start_va = 0x160000
end_va = 0x1d0fff
monitored = 0
entry_point = 0x169c00
region_type = mapped_file
name = "powershell.exe"
filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\powershell.exe")
Region:
id = 687
start_va = 0x1e0000
end_va = 0x41dffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001e0000"
filename = ""
Region:
id = 688
start_va = 0x4200000
end_va = 0x43fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004200000"
filename = ""
Region:
id = 689
start_va = 0x77460000
end_va = 0x775dafff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 690
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 691
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 692
start_va = 0x7fff0000
end_va = 0x7df884cbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 693
start_va = 0x7df884cc0000
end_va = 0x7ff884cbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df884cc0000"
filename = ""
Region:
id = 694
start_va = 0x7ff884cc0000
end_va = 0x7ff884e80fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 695
start_va = 0x7ff884e81000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ff884e81000"
filename = ""
Region:
id = 696
start_va = 0x4580000
end_va = 0x458ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004580000"
filename = ""
Region:
id = 697
start_va = 0x5f960000
end_va = 0x5f9affff
monitored = 0
entry_point = 0x5f978180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 698
start_va = 0x5f9b0000
end_va = 0x5fa29fff
monitored = 0
entry_point = 0x5f9c3290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 699
start_va = 0x76410000
end_va = 0x764effff
monitored = 0
entry_point = 0x76423980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 700
start_va = 0x5fa30000
end_va = 0x5fa37fff
monitored = 0
entry_point = 0x5fa317c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 701
start_va = 0x4400000
end_va = 0x453ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004400000"
filename = ""
Region:
id = 702
start_va = 0x76410000
end_va = 0x764effff
monitored = 0
entry_point = 0x76423980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 703
start_va = 0x77270000
end_va = 0x773edfff
monitored = 0
entry_point = 0x77321b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 704
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 705
start_va = 0x7feb0000
end_va = 0x7ffaffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007feb0000"
filename = ""
Region:
id = 889
start_va = 0x4590000
end_va = 0x464dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 890
start_va = 0x20000
end_va = 0x23fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 891
start_va = 0x76b70000
end_va = 0x76beafff
monitored = 0
entry_point = 0x76b8e970
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 892
start_va = 0x76570000
end_va = 0x7662dfff
monitored = 0
entry_point = 0x765a5630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 893
start_va = 0x110000
end_va = 0x14ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000110000"
filename = ""
Region:
id = 894
start_va = 0x4400000
end_va = 0x443ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004400000"
filename = ""
Region:
id = 895
start_va = 0x4440000
end_va = 0x453ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004440000"
filename = ""
Region:
id = 896
start_va = 0x758e0000
end_va = 0x75923fff
monitored = 0
entry_point = 0x758f9d80
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 897
start_va = 0x76630000
end_va = 0x766dcfff
monitored = 0
entry_point = 0x76644f00
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 898
start_va = 0x74190000
end_va = 0x741adfff
monitored = 0
entry_point = 0x7419b640
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 899
start_va = 0x74180000
end_va = 0x74189fff
monitored = 0
entry_point = 0x74182a00
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 900
start_va = 0x75880000
end_va = 0x758d7fff
monitored = 0
entry_point = 0x758c25c0
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")
Region:
id = 901
start_va = 0x767c0000
end_va = 0x768aafff
monitored = 0
entry_point = 0x767fd650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 902
start_va = 0x769b0000
end_va = 0x76b6cfff
monitored = 0
entry_point = 0x76a92a10
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")
Region:
id = 917
start_va = 0x6e1a0000
end_va = 0x6e1b7fff
monitored = 0
entry_point = 0x6e1a4820
region_type = mapped_file
name = "atl.dll"
filename = "\\Windows\\SysWOW64\\atl.dll" (normalized: "c:\\windows\\syswow64\\atl.dll")
Region:
id = 918
start_va = 0x76d80000
end_va = 0x76ecefff
monitored = 0
entry_point = 0x76e36820
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 920
start_va = 0x755e0000
end_va = 0x75726fff
monitored = 0
entry_point = 0x755f1cf0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 921
start_va = 0x76bf0000
end_va = 0x76c81fff
monitored = 0
entry_point = 0x76c28cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 922
start_va = 0x6e740000
end_va = 0x6e798fff
monitored = 1
entry_point = 0x6e750780
region_type = mapped_file
name = "mscoree.dll"
filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll")
Region:
id = 923
start_va = 0x4650000
end_va = 0x46affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004650000"
filename = ""
Region:
id = 924
start_va = 0x4540000
end_va = 0x4569fff
monitored = 0
entry_point = 0x4545680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 925
start_va = 0x46b0000
end_va = 0x4837fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000046b0000"
filename = ""
Region:
id = 926
start_va = 0x764f0000
end_va = 0x7651afff
monitored = 0
entry_point = 0x764f5680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 927
start_va = 0x30000
end_va = 0x31fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 928
start_va = 0x150000
end_va = 0x150fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000150000"
filename = ""
Region:
id = 929
start_va = 0x41e0000
end_va = 0x41e2fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "powershell.exe.mui"
filename = "\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui" (normalized: "c:\\windows\\syswow64\\windowspowershell\\v1.0\\en-us\\powershell.exe.mui")
Region:
id = 930
start_va = 0x4840000
end_va = 0x49c0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004840000"
filename = ""
Region:
id = 931
start_va = 0x49d0000
end_va = 0x5dcffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000049d0000"
filename = ""
Region:
id = 936
start_va = 0x41f0000
end_va = 0x41f0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000041f0000"
filename = ""
Region:
id = 937
start_va = 0x4540000
end_va = 0x4540fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004540000"
filename = ""
Region:
id = 938
start_va = 0x5dd0000
end_va = 0x5eaffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005dd0000"
filename = ""
Region:
id = 942
start_va = 0x6c6a0000
end_va = 0x6c718fff
monitored = 1
entry_point = 0x6c6af82a
region_type = mapped_file
name = "mscoreei.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")
Region:
id = 945
start_va = 0x76ed0000
end_va = 0x76f14fff
monitored = 0
entry_point = 0x76eede90
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 946
start_va = 0x755d0000
end_va = 0x755dbfff
monitored = 0
entry_point = 0x755d3930
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")
Region:
id = 947
start_va = 0x71780000
end_va = 0x71787fff
monitored = 0
entry_point = 0x717817b0
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")
Region:
id = 948
start_va = 0x6bfe0000
end_va = 0x6c690fff
monitored = 1
entry_point = 0x6bff5d20
region_type = mapped_file
name = "clr.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")
Region:
id = 949
start_va = 0x71680000
end_va = 0x71774fff
monitored = 0
entry_point = 0x716d4160
region_type = mapped_file
name = "msvcr120_clr0400.dll"
filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll")
Region:
id = 1433
start_va = 0x4550000
end_va = 0x4550fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004550000"
filename = ""
Region:
id = 1434
start_va = 0x4560000
end_va = 0x456ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004560000"
filename = ""
Region:
id = 1435
start_va = 0x4570000
end_va = 0x457ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004570000"
filename = ""
Region:
id = 1436
start_va = 0x4650000
end_va = 0x465ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004650000"
filename = ""
Region:
id = 1437
start_va = 0x46a0000
end_va = 0x46affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000046a0000"
filename = ""
Region:
id = 1438
start_va = 0x4660000
end_va = 0x466ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004660000"
filename = ""
Region:
id = 1439
start_va = 0x4670000
end_va = 0x467ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004670000"
filename = ""
Region:
id = 1440
start_va = 0x4680000
end_va = 0x468ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004680000"
filename = ""
Region:
id = 1441
start_va = 0x4690000
end_va = 0x4690fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004690000"
filename = ""
Region:
id = 1442
start_va = 0x5dd0000
end_va = 0x5dd0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005dd0000"
filename = ""
Region:
id = 1443
start_va = 0x5ea0000
end_va = 0x5eaffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005ea0000"
filename = ""
Region:
id = 1444
start_va = 0x5eb0000
end_va = 0x5ffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005eb0000"
filename = ""
Region:
id = 1445
start_va = 0x6000000
end_va = 0x618ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006000000"
filename = ""
Region:
id = 1446
start_va = 0x5de0000
end_va = 0x5e1ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005de0000"
filename = ""
Region:
id = 1447
start_va = 0x5e20000
end_va = 0x5e5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005e20000"
filename = ""
Region:
id = 1448
start_va = 0x5e60000
end_va = 0x5e6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005e60000"
filename = ""
Region:
id = 1449
start_va = 0x6190000
end_va = 0x818ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006190000"
filename = ""
Region:
id = 1450
start_va = 0x5e60000
end_va = 0x5e7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005e60000"
filename = ""
Region:
id = 1451
start_va = 0x5eb0000
end_va = 0x5eeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005eb0000"
filename = ""
Region:
id = 1452
start_va = 0x5ef0000
end_va = 0x5f2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005ef0000"
filename = ""
Region:
id = 1453
start_va = 0x5ff0000
end_va = 0x5ffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005ff0000"
filename = ""
Region:
id = 1454
start_va = 0x8190000
end_va = 0x84c6fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1455
start_va = 0x6adb0000
end_va = 0x6bfd7fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "mscorlib.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll")
Region:
id = 1456
start_va = 0x84d0000
end_va = 0x86bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000084d0000"
filename = ""
Region:
id = 1457
start_va = 0x5e80000
end_va = 0x5e8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005e80000"
filename = ""
Region:
id = 1500
start_va = 0x6a400000
end_va = 0x6adabfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\cc4e5d110dd318e8b7d61a9ed184ab74\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\cc4e5d110dd318e8b7d61a9ed184ab74\\system.ni.dll")
Region:
id = 1501
start_va = 0x68ce0000
end_va = 0x693f1fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.core.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\abad45b9cc652ba7e38c4c837234c0ab\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\abad45b9cc652ba7e38c4c837234c0ab\\system.core.ni.dll")
Region:
id = 1502
start_va = 0x68930000
end_va = 0x689bafff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "microsoft.powershell.consolehost.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Pb378ec07#\\24c2ce3e0888a5f9c613c20443ec3711\\Microsoft.PowerShell.ConsoleHost.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.pb378ec07#\\24c2ce3e0888a5f9c613c20443ec3711\\microsoft.powershell.consolehost.ni.dll")
Region:
id = 1503
start_va = 0x70040000
end_va = 0x70052fff
monitored = 0
entry_point = 0x70049950
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")
Region:
id = 1504
start_va = 0x70010000
end_va = 0x7003efff
monitored = 0
entry_point = 0x700295e0
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 1505
start_va = 0x73e30000
end_va = 0x73e4afff
monitored = 0
entry_point = 0x73e39050
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")
Region:
id = 1580
start_va = 0x67080000
end_va = 0x6892dfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.management.automation.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Manaa57fc8cc#\\1ccb63704392d146fb118a3c7c02e118\\System.Management.Automation.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.manaa57fc8cc#\\1ccb63704392d146fb118a3c7c02e118\\system.management.automation.ni.dll")
Region:
id = 1592
start_va = 0x5f30000
end_va = 0x5f91fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "mscorrc.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorrc.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscorrc.dll")
Region:
id = 1611
start_va = 0x5e90000
end_va = 0x5e94fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "winnlsres.dll"
filename = "\\Windows\\SysWOW64\\winnlsres.dll" (normalized: "c:\\windows\\syswow64\\winnlsres.dll")
Region:
id = 1612
start_va = 0x5fa0000
end_va = 0x5faffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "winnlsres.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\winnlsres.dll.mui")
Region:
id = 1619
start_va = 0x75930000
end_va = 0x75935fff
monitored = 0
entry_point = 0x75931460
region_type = mapped_file
name = "psapi.dll"
filename = "\\Windows\\SysWOW64\\psapi.dll" (normalized: "c:\\windows\\syswow64\\psapi.dll")
Region:
id = 1622
start_va = 0x6000000
end_va = 0x60fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006000000"
filename = ""
Region:
id = 1623
start_va = 0x6180000
end_va = 0x618ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006180000"
filename = ""
Region:
id = 1641
start_va = 0x69460000
end_va = 0x694a3fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.numerics.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Numerics\\4d1e79f86c195a48bfb3d1e5ca404930\\System.Numerics.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.numerics\\4d1e79f86c195a48bfb3d1e5ca404930\\system.numerics.ni.dll")
Region:
id = 1642
start_va = 0x5fb0000
end_va = 0x5fbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005fb0000"
filename = ""
Region:
id = 1646
start_va = 0x68b10000
end_va = 0x68b89fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "microsoft.management.infrastructure.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.Mf49f6405#\\c5cf09a01c434d73a149336798330955\\Microsoft.Management.Infrastructure.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.mf49f6405#\\c5cf09a01c434d73a149336798330955\\microsoft.management.infrastructure.ni.dll")
Region:
id = 1659
start_va = 0x66960000
end_va = 0x67075fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.xml.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\1f87b5140145c221b5201351fffc52d8\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\1f87b5140145c221b5201351fffc52d8\\system.xml.ni.dll")
Region:
id = 1669
start_va = 0x5fc0000
end_va = 0x5fcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005fc0000"
filename = ""
Region:
id = 1676
start_va = 0x689f0000
end_va = 0x68b0bfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.directoryservices.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Dired13b18a9#\\495b4726107659a7a7f716d2b34703ce\\System.DirectoryServices.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.dired13b18a9#\\495b4726107659a7a7f716d2b34703ce\\system.directoryservices.ni.dll")
Region:
id = 1677
start_va = 0x66840000
end_va = 0x6695bfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.management.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\d2f554a0c84513cd793fdcd77a86dab1\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\d2f554a0c84513cd793fdcd77a86dab1\\system.management.ni.dll")
Region:
id = 1678
start_va = 0x5fd0000
end_va = 0x5fdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005fd0000"
filename = ""
Region:
id = 1771
start_va = 0x5fe0000
end_va = 0x5feffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005fe0000"
filename = ""
Region:
id = 1782
start_va = 0x6100000
end_va = 0x610ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006100000"
filename = ""
Region:
id = 1784
start_va = 0x6110000
end_va = 0x611ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006110000"
filename = ""
Region:
id = 1785
start_va = 0x6120000
end_va = 0x612ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006120000"
filename = ""
Region:
id = 1802
start_va = 0x6130000
end_va = 0x613ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006130000"
filename = ""
Region:
id = 1803
start_va = 0x6140000
end_va = 0x614ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006140000"
filename = ""
Region:
id = 1809
start_va = 0x6150000
end_va = 0x615ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006150000"
filename = ""
Region:
id = 1813
start_va = 0x6160000
end_va = 0x616ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006160000"
filename = ""
Region:
id = 1814
start_va = 0x6170000
end_va = 0x617ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006170000"
filename = ""
Region:
id = 1818
start_va = 0x69400000
end_va = 0x69425fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.configuration.install.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Confe64a9051#\\1ba9fabb6a4cb3c022579f789ba3280b\\System.Configuration.Install.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.confe64a9051#\\1ba9fabb6a4cb3c022579f789ba3280b\\system.configuration.install.ni.dll")
Region:
id = 1819
start_va = 0x66790000
end_va = 0x6683dfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.transactions.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Transactions\\8a03e2886313defa91cef9f385480f4e\\System.Transactions.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.transactions\\8a03e2886313defa91cef9f385480f4e\\system.transactions.ni.dll")
Region:
id = 1820
start_va = 0x66740000
end_va = 0x6678afff
monitored = 1
entry_point = 0x6675f53e
region_type = mapped_file
name = "system.transactions.dll"
filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll")
Region:
id = 1821
start_va = 0x84d0000
end_va = 0x851afff
monitored = 1
entry_point = 0x84ef53e
region_type = mapped_file
name = "system.transactions.dll"
filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\System.Transactions\\v4.0_4.0.0.0__b77a5c561934e089\\System.Transactions.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\system.transactions\\v4.0_4.0.0.0__b77a5c561934e089\\system.transactions.dll")
Region:
id = 1822
start_va = 0x86b0000
end_va = 0x86bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000086b0000"
filename = ""
Region:
id = 1868
start_va = 0x689e0000
end_va = 0x689e4fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.diagnostics.tracing.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Diagd2d95910#\\00f2884f94840274aeab684b7683f0fb\\System.Diagnostics.Tracing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.diagd2d95910#\\00f2884f94840274aeab684b7683f0fb\\system.diagnostics.tracing.ni.dll")
Region:
id = 1890
start_va = 0x741b0000
end_va = 0x755aefff
monitored = 0
entry_point = 0x7436b990
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")
Region:
id = 1891
start_va = 0x75940000
end_va = 0x75976fff
monitored = 0
entry_point = 0x75943b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")
Region:
id = 1892
start_va = 0x75f10000
end_va = 0x76408fff
monitored = 0
entry_point = 0x76117610
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")
Region:
id = 1893
start_va = 0x76cf0000
end_va = 0x76d7cfff
monitored = 0
entry_point = 0x76d39b90
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")
Region:
id = 1894
start_va = 0x766e0000
end_va = 0x76723fff
monitored = 0
entry_point = 0x766e7410
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")
Region:
id = 1895
start_va = 0x77450000
end_va = 0x7745efff
monitored = 0
entry_point = 0x77452e40
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")
Region:
id = 1896
start_va = 0x84d0000
end_va = 0x84d0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000084d0000"
filename = ""
Region:
id = 1897
start_va = 0x84e0000
end_va = 0x84e0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "tzres.dll"
filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")
Region:
id = 1898
start_va = 0x84e0000
end_va = 0x84e8fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "tzres.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")
Region:
id = 1899
start_va = 0x84e0000
end_va = 0x84e0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "tzres.dll"
filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")
Region:
id = 1900
start_va = 0x84e0000
end_va = 0x84e8fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "tzres.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")
Region:
id = 1901
start_va = 0x84e0000
end_va = 0x84e0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "tzres.dll"
filename = "\\Windows\\SysWOW64\\tzres.dll" (normalized: "c:\\windows\\syswow64\\tzres.dll")
Region:
id = 1902
start_va = 0x84e0000
end_va = 0x84e8fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "tzres.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\tzres.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\tzres.dll.mui")
Region:
id = 1923
start_va = 0x84e0000
end_va = 0x851ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000084e0000"
filename = ""
Region:
id = 1924
start_va = 0x8520000
end_va = 0x855ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008520000"
filename = ""
Region:
id = 1925
start_va = 0x8560000
end_va = 0x859ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008560000"
filename = ""
Region:
id = 1926
start_va = 0x85a0000
end_va = 0x85dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000085a0000"
filename = ""
Region:
id = 1956
start_va = 0x71600000
end_va = 0x7167dfff
monitored = 1
entry_point = 0x71601140
region_type = mapped_file
name = "clrjit.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")
Region:
id = 1957
start_va = 0x85e0000
end_va = 0x85effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000085e0000"
filename = ""
Region:
id = 1960
start_va = 0x85f0000
end_va = 0x85fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000085f0000"
filename = ""
Region:
id = 1961
start_va = 0x666f0000
end_va = 0x6673ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "microsoft.powershell.security.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\Microsoft.P6f792626#\\24dec2ee5afa2e530624f4ea9795a28f\\Microsoft.PowerShell.Security.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\microsoft.p6f792626#\\24dec2ee5afa2e530624f4ea9795a28f\\microsoft.powershell.security.ni.dll")
Thread:
id = 14
os_tid = 0x5e4
Thread:
id = 24
os_tid = 0x1068
Thread:
id = 109
os_tid = 0x708
Thread:
id = 110
os_tid = 0x13a8
Thread:
id = 145
os_tid = 0x1190
Thread:
id = 146
os_tid = 0x1330
Process:
id = "3"
image_name = "conhost.exe"
filename = "c:\\windows\\system32\\conhost.exe"
page_root = "0x72445000"
os_pid = "0xae0"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "2"
os_parent_pid = "0x9c8"
cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1"
cur_dir = "C:\\Windows"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f600" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 724
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 725
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 726
start_va = 0x50000
end_va = 0x8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 727
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 728
start_va = 0x400000
end_va = 0x5fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 729
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 730
start_va = 0x7df5fffc0000
end_va = 0x7df5fffe2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5fffc0000"
filename = ""
Region:
id = 731
start_va = 0x7df5ffff0000
end_va = 0x7ff5fffeffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffff0000"
filename = ""
Region:
id = 732
start_va = 0x7ff78ce40000
end_va = 0x7ff78ce50fff
monitored = 0
entry_point = 0x7ff78ce416b0
region_type = mapped_file
name = "conhost.exe"
filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe")
Region:
id = 733
start_va = 0x7ff884cc0000
end_va = 0x7ff884e80fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 734
start_va = 0x700000
end_va = 0x7fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000700000"
filename = ""
Region:
id = 735
start_va = 0x7ff881ed0000
end_va = 0x7ff8820b7fff
monitored = 0
entry_point = 0x7ff881efba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 736
start_va = 0x7ff884c10000
end_va = 0x7ff884cbcfff
monitored = 0
entry_point = 0x7ff884c281a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 737
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 738
start_va = 0x7df5ffec0000
end_va = 0x7df5fffbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffec0000"
filename = ""
Region:
id = 739
start_va = 0x90000
end_va = 0x14dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 740
start_va = 0x7ff882220000
end_va = 0x7ff8822bcfff
monitored = 0
entry_point = 0x7ff8822278a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 741
start_va = 0x150000
end_va = 0x18ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000150000"
filename = ""
Region:
id = 742
start_va = 0x600000
end_va = 0x6cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000600000"
filename = ""
Region:
id = 743
start_va = 0x20000
end_va = 0x26fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 744
start_va = 0x7ff876920000
end_va = 0x7ff876978fff
monitored = 0
entry_point = 0x7ff87692fbf0
region_type = mapped_file
name = "conhostv2.dll"
filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll")
Region:
id = 745
start_va = 0x190000
end_va = 0x190fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000190000"
filename = ""
Region:
id = 746
start_va = 0x7ff8822c0000
end_va = 0x7ff88253cfff
monitored = 0
entry_point = 0x7ff882394970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 747
start_va = 0x7ff883bf0000
end_va = 0x7ff883d0bfff
monitored = 0
entry_point = 0x7ff883c302b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 748
start_va = 0x7ff881d50000
end_va = 0x7ff881db9fff
monitored = 0
entry_point = 0x7ff881d86d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 749
start_va = 0x7ff8820c0000
end_va = 0x7ff882215fff
monitored = 0
entry_point = 0x7ff8820ca8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 750
start_va = 0x7ff884a10000
end_va = 0x7ff884b95fff
monitored = 0
entry_point = 0x7ff884a5ffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 751
start_va = 0x1a0000
end_va = 0x1a6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001a0000"
filename = ""
Region:
id = 752
start_va = 0x7ff8842c0000
end_va = 0x7ff884402fff
monitored = 0
entry_point = 0x7ff8842e8210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 753
start_va = 0x7ff882550000
end_va = 0x7ff8825aafff
monitored = 0
entry_point = 0x7ff8825638b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 754
start_va = 0x7ff8849d0000
end_va = 0x7ff884a0afff
monitored = 0
entry_point = 0x7ff8849d12f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 755
start_va = 0x7ff884410000
end_va = 0x7ff8844d0fff
monitored = 0
entry_point = 0x7ff884430da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 756
start_va = 0x7ff87f8e0000
end_va = 0x7ff87fa65fff
monitored = 0
entry_point = 0x7ff87f92d700
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")
Region:
id = 757
start_va = 0x1b0000
end_va = 0x1b0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001b0000"
filename = ""
Region:
id = 758
start_va = 0x1c0000
end_va = 0x1c0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 759
start_va = 0x800000
end_va = 0x987fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000800000"
filename = ""
Region:
id = 760
start_va = 0x990000
end_va = 0xb10fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000990000"
filename = ""
Region:
id = 761
start_va = 0xb20000
end_va = 0x1f1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000b20000"
filename = ""
Region:
id = 762
start_va = 0x1f20000
end_va = 0x206ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001f20000"
filename = ""
Region:
id = 769
start_va = 0x600000
end_va = 0x63ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000600000"
filename = ""
Region:
id = 770
start_va = 0x6c0000
end_va = 0x6cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006c0000"
filename = ""
Region:
id = 771
start_va = 0x7ff8825b0000
end_va = 0x7ff883b0efff
monitored = 0
entry_point = 0x7ff8827111f0
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 776
start_va = 0x7ff881370000
end_va = 0x7ff8813b2fff
monitored = 0
entry_point = 0x7ff881384b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 777
start_va = 0x7ff881620000
end_va = 0x7ff881c63fff
monitored = 0
entry_point = 0x7ff8817e64b0
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")
Region:
id = 799
start_va = 0x7ff884920000
end_va = 0x7ff8849c6fff
monitored = 0
entry_point = 0x7ff8849358d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 800
start_va = 0x7ff884bb0000
end_va = 0x7ff884c01fff
monitored = 0
entry_point = 0x7ff884bbf530
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 813
start_va = 0x7ff881330000
end_va = 0x7ff88133efff
monitored = 0
entry_point = 0x7ff881333210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 814
start_va = 0x7ff881c70000
end_va = 0x7ff881d24fff
monitored = 0
entry_point = 0x7ff881cb22e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 822
start_va = 0x7ff8812e0000
end_va = 0x7ff88132afff
monitored = 0
entry_point = 0x7ff8812e35f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 823
start_va = 0x7ff881340000
end_va = 0x7ff881353fff
monitored = 0
entry_point = 0x7ff8813452e0
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 824
start_va = 0x7ff87fc60000
end_va = 0x7ff87fcf5fff
monitored = 0
entry_point = 0x7ff87fc85570
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 835
start_va = 0x2070000
end_va = 0x225ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002070000"
filename = ""
Region:
id = 838
start_va = 0x2260000
end_va = 0x2596fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 839
start_va = 0x1f20000
end_va = 0x201ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001f20000"
filename = ""
Region:
id = 840
start_va = 0x2060000
end_va = 0x206ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002060000"
filename = ""
Region:
id = 841
start_va = 0x25a0000
end_va = 0x279ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000025a0000"
filename = ""
Region:
id = 847
start_va = 0x640000
end_va = 0x67ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000640000"
filename = ""
Region:
id = 848
start_va = 0x7ff883ec0000
end_va = 0x7ff884019fff
monitored = 0
entry_point = 0x7ff883f038e0
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 851
start_va = 0x50000
end_va = 0x50fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000050000"
filename = ""
Region:
id = 852
start_va = 0x2070000
end_va = 0x212bfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002070000"
filename = ""
Region:
id = 853
start_va = 0x2250000
end_va = 0x225ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002250000"
filename = ""
Region:
id = 854
start_va = 0x50000
end_va = 0x53fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000050000"
filename = ""
Region:
id = 855
start_va = 0x7ff87eb60000
end_va = 0x7ff87eb81fff
monitored = 0
entry_point = 0x7ff87eb61a40
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")
Region:
id = 856
start_va = 0x7ff87fad0000
end_va = 0x7ff87fae2fff
monitored = 0
entry_point = 0x7ff87fad2760
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")
Region:
id = 865
start_va = 0x7ff8810f0000
end_va = 0x7ff881145fff
monitored = 0
entry_point = 0x7ff881100bf0
region_type = mapped_file
name = "winsta.dll"
filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")
Region:
id = 874
start_va = 0x60000
end_va = 0x66fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000060000"
filename = ""
Region:
id = 875
start_va = 0x70000
end_va = 0x70fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000070000"
filename = ""
Region:
id = 876
start_va = 0x80000
end_va = 0x80fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000080000"
filename = ""
Region:
id = 877
start_va = 0x1d0000
end_va = 0x1d1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001d0000"
filename = ""
Region:
id = 878
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001e0000"
filename = ""
Region:
id = 879
start_va = 0x1f0000
end_va = 0x1f4fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "user32.dll.mui"
filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui")
Region:
id = 880
start_va = 0x680000
end_va = 0x680fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "conhostv2.dll.mui"
filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui")
Region:
id = 881
start_va = 0x690000
end_va = 0x691fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000690000"
filename = ""
Region:
id = 882
start_va = 0x7ff875c70000
end_va = 0x7ff875ee3fff
monitored = 0
entry_point = 0x7ff875ce0400
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll")
Region:
id = 887
start_va = 0x6a0000
end_va = 0x6a0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "windowsshell.manifest"
filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")
Region:
id = 888
start_va = 0x6b0000
end_va = 0x6b1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000006b0000"
filename = ""
Thread:
id = 15
os_tid = 0x340
Thread:
id = 17
os_tid = 0x740
Thread:
id = 18
os_tid = 0x9f0
Thread:
id = 22
os_tid = 0x1054
Process:
id = "4"
image_name = "schtasks.exe"
filename = "c:\\windows\\syswow64\\schtasks.exe"
page_root = "0x72468000"
os_pid = "0xe28"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "1"
os_parent_pid = "0x6d8"
cmd_line = "\"C:\\Windows\\System32\\schtasks.exe\" /Create /TN \"Updates\\lyfhOEwABQlG\" /XML \"C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp\""
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f600" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 706
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 707
start_va = 0x30000
end_va = 0x31fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 708
start_va = 0x40000
end_va = 0x54fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 709
start_va = 0x60000
end_va = 0x63fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000060000"
filename = ""
Region:
id = 710
start_va = 0x70000
end_va = 0x70fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000070000"
filename = ""
Region:
id = 711
start_va = 0x80000
end_va = 0x81fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000080000"
filename = ""
Region:
id = 712
start_va = 0x90000
end_va = 0xc1fff
monitored = 1
entry_point = 0xb05b0
region_type = mapped_file
name = "schtasks.exe"
filename = "\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")
Region:
id = 713
start_va = 0xd0000
end_va = 0x40cffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 714
start_va = 0x40d0000
end_va = 0x410ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000040d0000"
filename = ""
Region:
id = 715
start_va = 0x4110000
end_va = 0x414ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004110000"
filename = ""
Region:
id = 716
start_va = 0x4200000
end_va = 0x43fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004200000"
filename = ""
Region:
id = 717
start_va = 0x77460000
end_va = 0x775dafff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 718
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 719
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 720
start_va = 0x7fff0000
end_va = 0x7df884cbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 721
start_va = 0x7df884cc0000
end_va = 0x7ff884cbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df884cc0000"
filename = ""
Region:
id = 722
start_va = 0x7ff884cc0000
end_va = 0x7ff884e80fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 723
start_va = 0x7ff884e81000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ff884e81000"
filename = ""
Region:
id = 763
start_va = 0x44b0000
end_va = 0x44bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000044b0000"
filename = ""
Region:
id = 764
start_va = 0x5f960000
end_va = 0x5f9affff
monitored = 0
entry_point = 0x5f978180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 765
start_va = 0x5f9b0000
end_va = 0x5fa29fff
monitored = 0
entry_point = 0x5f9c3290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 766
start_va = 0x76410000
end_va = 0x764effff
monitored = 0
entry_point = 0x76423980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 767
start_va = 0x5fa30000
end_va = 0x5fa37fff
monitored = 0
entry_point = 0x5fa317c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 768
start_va = 0x44c0000
end_va = 0x46bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000044c0000"
filename = ""
Region:
id = 772
start_va = 0x76410000
end_va = 0x764effff
monitored = 0
entry_point = 0x76423980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 773
start_va = 0x77270000
end_va = 0x773edfff
monitored = 0
entry_point = 0x77321b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 774
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 775
start_va = 0x7feb0000
end_va = 0x7ffaffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007feb0000"
filename = ""
Region:
id = 903
start_va = 0x44c0000
end_va = 0x457dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 904
start_va = 0x45c0000
end_va = 0x46bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000045c0000"
filename = ""
Region:
id = 905
start_va = 0x20000
end_va = 0x23fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 906
start_va = 0x76570000
end_va = 0x7662dfff
monitored = 0
entry_point = 0x765a5630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 907
start_va = 0x4150000
end_va = 0x418ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004150000"
filename = ""
Region:
id = 908
start_va = 0x4190000
end_va = 0x41cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004190000"
filename = ""
Region:
id = 909
start_va = 0x76bf0000
end_va = 0x76c81fff
monitored = 0
entry_point = 0x76c28cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 910
start_va = 0x769b0000
end_va = 0x76b6cfff
monitored = 0
entry_point = 0x76a92a10
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")
Region:
id = 911
start_va = 0x76630000
end_va = 0x766dcfff
monitored = 0
entry_point = 0x76644f00
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 912
start_va = 0x74190000
end_va = 0x741adfff
monitored = 0
entry_point = 0x7419b640
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 913
start_va = 0x74180000
end_va = 0x74189fff
monitored = 0
entry_point = 0x74182a00
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 914
start_va = 0x75880000
end_va = 0x758d7fff
monitored = 0
entry_point = 0x758c25c0
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")
Region:
id = 915
start_va = 0x758e0000
end_va = 0x75923fff
monitored = 0
entry_point = 0x758f9d80
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 916
start_va = 0x4400000
end_va = 0x445ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004400000"
filename = ""
Region:
id = 919
start_va = 0x46c0000
end_va = 0x47a9fff
monitored = 0
entry_point = 0x46fd650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 932
start_va = 0x30000
end_va = 0x31fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 933
start_va = 0x41d0000
end_va = 0x41d0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000041d0000"
filename = ""
Region:
id = 934
start_va = 0x46c0000
end_va = 0x4abafff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000046c0000"
filename = ""
Region:
id = 935
start_va = 0x4ac0000
end_va = 0x4df6fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 939
start_va = 0x755d0000
end_va = 0x755dbfff
monitored = 0
entry_point = 0x755d3930
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")
Region:
id = 940
start_va = 0x41e0000
end_va = 0x41e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000041e0000"
filename = ""
Region:
id = 941
start_va = 0x76730000
end_va = 0x767b3fff
monitored = 0
entry_point = 0x76756220
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")
Region:
id = 943
start_va = 0x41f0000
end_va = 0x41f0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000041f0000"
filename = ""
Region:
id = 944
start_va = 0x68930000
end_va = 0x689bbfff
monitored = 0
entry_point = 0x6896a6c0
region_type = mapped_file
name = "taskschd.dll"
filename = "\\Windows\\SysWOW64\\taskschd.dll" (normalized: "c:\\windows\\syswow64\\taskschd.dll")
Thread:
id = 16
os_tid = 0x1284
[0219.913] GetModuleHandleA (lpModuleName=0x0) returned 0x90000
[0219.913] __set_app_type (_Type=0x1)
[0219.913] __p__fmode () returned 0x76624d6c
[0219.913] __p__commode () returned 0x76625b1c
[0219.913] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0xb0840) returned 0x0
[0219.913] __wgetmainargs (in: _Argc=0xbade0, _Argv=0xbade4, _Env=0xbade8, _DoWildCard=0, _StartInfo=0xbadf4 | out: _Argc=0xbade0, _Argv=0xbade4, _Env=0xbade8) returned 0
[0219.914] _onexit (_Func=0xb2bc0) returned 0xb2bc0
[0219.914] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1
[0219.914] WinSqmIsOptedIn () returned 0x0
[0219.914] GetProcessHeap () returned 0x45c0000
[0219.915] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x10) returned 0x45c7438
[0219.915] RtlRestoreLastWin32Error () returned 0x0
[0219.915] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18
[0219.915] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b
[0219.915] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b
[0219.915] RtlVerifyVersionInfo (VersionInfo=0x414f9f8, TypeMask=0x3, ConditionMask=0x1801b) returned 0x0
[0219.915] GetProcessHeap () returned 0x45c0000
[0219.915] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x10) returned 0x45c7450
[0219.915] lstrlenW (lpString="") returned 0
[0219.915] GetProcessHeap () returned 0x45c0000
[0219.915] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x2) returned 0x45c0598
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c6e48
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x10) returned 0x45c7468
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c6c10
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c6c30
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c6c50
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c6840
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x10) returned 0x45c7480
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c6860
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c6880
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c65d8
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c65f8
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x10) returned 0x45c73d8
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c6618
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c2780
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c27a0
[0219.916] GetProcessHeap () returned 0x45c0000
[0219.916] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c27c0
[0219.916] SetThreadUILanguage (LangId=0x0) returned 0x409
[0219.958] RtlRestoreLastWin32Error () returned 0x0
[0219.958] GetProcessHeap () returned 0x45c0000
[0219.958] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c94e8
[0219.958] GetProcessHeap () returned 0x45c0000
[0219.958] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c9568
[0219.958] GetProcessHeap () returned 0x45c0000
[0219.958] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c9348
[0219.958] GetProcessHeap () returned 0x45c0000
[0219.958] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c9368
[0219.958] GetProcessHeap () returned 0x45c0000
[0219.958] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c9428
[0219.958] GetProcessHeap () returned 0x45c0000
[0219.958] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x10) returned 0x45c74e0
[0219.959] _memicmp (_Buf1=0x45c74e0, _Buf2=0x92708, _Size=0x7) returned 0
[0219.959] GetProcessHeap () returned 0x45c0000
[0219.959] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x208) returned 0x45c8ce0
[0219.959] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45c8ce0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20
[0219.959] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0x414fb04 | out: lpdwHandle=0x414fb04) returned 0x76c
[0219.991] GetProcessHeap () returned 0x45c0000
[0219.991] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x776) returned 0x45c9db8
[0219.992] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x45c9db8 | out: lpData=0x45c9db8) returned 1
[0219.992] VerQueryValueW (in: pBlock=0x45c9db8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x414fb0c, puLen=0x414fb10 | out: lplpBuffer=0x414fb0c*=0x45ca168, puLen=0x414fb10) returned 1
[0219.996] _memicmp (_Buf1=0x45c74e0, _Buf2=0x92708, _Size=0x7) returned 0
[0219.996] _vsnwprintf (in: _Buffer=0x45c8ce0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x414faf0 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37
[0219.996] VerQueryValueW (in: pBlock=0x45c9db8, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x414fb1c, puLen=0x414fb18 | out: lplpBuffer=0x414fb1c*=0x45c9f98, puLen=0x414fb18) returned 1
[0219.996] lstrlenW (lpString="schtasks.exe") returned 12
[0219.996] lstrlenW (lpString="schtasks.exe") returned 12
[0219.996] lstrlenW (lpString=".EXE") returned 4
[0219.997] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe"
[0219.997] lstrlenW (lpString="schtasks.exe") returned 12
[0219.997] lstrlenW (lpString=".EXE") returned 4
[0219.997] _memicmp (_Buf1=0x45c74e0, _Buf2=0x92708, _Size=0x7) returned 0
[0219.997] lstrlenW (lpString="schtasks") returned 8
[0219.997] GetProcessHeap () returned 0x45c0000
[0219.997] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c9588
[0219.997] GetProcessHeap () returned 0x45c0000
[0219.997] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c93a8
[0219.997] GetProcessHeap () returned 0x45c0000
[0219.997] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c9628
[0219.997] GetProcessHeap () returned 0x45c0000
[0219.998] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c9468
[0219.998] GetProcessHeap () returned 0x45c0000
[0219.998] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x10) returned 0x45c7498
[0219.998] _memicmp (_Buf1=0x45c7498, _Buf2=0x92708, _Size=0x7) returned 0
[0219.998] GetProcessHeap () returned 0x45c0000
[0219.998] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0xa0) returned 0x45c69e0
[0219.998] GetProcessHeap () returned 0x45c0000
[0219.998] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c9488
[0219.998] GetProcessHeap () returned 0x45c0000
[0219.998] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c94c8
[0219.998] GetProcessHeap () returned 0x45c0000
[0219.998] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c93e8
[0219.998] GetProcessHeap () returned 0x45c0000
[0219.998] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x10) returned 0x45c73f0
[0219.998] _memicmp (_Buf1=0x45c73f0, _Buf2=0x92708, _Size=0x7) returned 0
[0219.998] GetProcessHeap () returned 0x45c0000
[0219.998] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x200) returned 0x45ca798
[0219.998] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x45ca798, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17
[0220.000] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23
[0220.000] GetProcessHeap () returned 0x45c0000
[0220.000] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x30) returned 0x45c6a88
[0220.000] _vsnwprintf (in: _Buffer=0x45c69e0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x414faf4 | out: _Buffer="Type \"SCHTASKS /?\" for usage.") returned 29
[0220.000] GetProcessHeap () returned 0x45c0000
[0220.000] GetProcessHeap () returned 0x45c0000
[0220.000] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9db8) returned 1
[0220.000] GetProcessHeap () returned 0x45c0000
[0220.000] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9db8) returned 0x776
[0220.001] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9db8) returned 1
[0220.001] RtlRestoreLastWin32Error () returned 0x0
[0220.001] GetThreadLocale () returned 0x409
[0220.001] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.001] lstrlenW (lpString="?") returned 1
[0220.002] GetThreadLocale () returned 0x409
[0220.002] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.002] lstrlenW (lpString="create") returned 6
[0220.002] GetThreadLocale () returned 0x409
[0220.002] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.002] lstrlenW (lpString="delete") returned 6
[0220.002] GetThreadLocale () returned 0x409
[0220.002] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.002] lstrlenW (lpString="query") returned 5
[0220.002] GetThreadLocale () returned 0x409
[0220.002] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.002] lstrlenW (lpString="change") returned 6
[0220.002] GetThreadLocale () returned 0x409
[0220.002] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.002] lstrlenW (lpString="run") returned 3
[0220.003] GetThreadLocale () returned 0x409
[0220.003] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.003] lstrlenW (lpString="end") returned 3
[0220.003] GetThreadLocale () returned 0x409
[0220.003] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.003] lstrlenW (lpString="showsid") returned 7
[0220.003] GetThreadLocale () returned 0x409
[0220.003] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.003] RtlRestoreLastWin32Error () returned 0x0
[0220.003] RtlRestoreLastWin32Error () returned 0x0
[0220.003] lstrlenW (lpString="/Create") returned 7
[0220.003] lstrlenW (lpString="-/") returned 2
[0220.003] StrChrIW (lpStart="-/", wMatch=0x445002f) returned="/"
[0220.003] lstrlenW (lpString="?") returned 1
[0220.003] lstrlenW (lpString="?") returned 1
[0220.003] GetProcessHeap () returned 0x45c0000
[0220.003] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x10) returned 0x45c73a8
[0220.003] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.003] GetProcessHeap () returned 0x45c0000
[0220.003] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0xa) returned 0x45c74c8
[0220.004] lstrlenW (lpString="Create") returned 6
[0220.004] GetProcessHeap () returned 0x45c0000
[0220.004] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x10) returned 0x45c7408
[0220.004] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.004] GetProcessHeap () returned 0x45c0000
[0220.004] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c94a8
[0220.004] _vsnwprintf (in: _Buffer=0x45c74c8, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|?|") returned 3
[0220.004] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x9, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|Create|") returned 8
[0220.004] lstrlenW (lpString="|?|") returned 3
[0220.004] lstrlenW (lpString="|Create|") returned 8
[0220.004] RtlRestoreLastWin32Error () returned 0x490
[0220.004] lstrlenW (lpString="create") returned 6
[0220.004] lstrlenW (lpString="create") returned 6
[0220.004] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.004] GetProcessHeap () returned 0x45c0000
[0220.004] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c74c8) returned 1
[0220.004] GetProcessHeap () returned 0x45c0000
[0220.004] RtlReAllocateHeap (Heap=0x45c0000, Flags=0xc, Ptr=0x45c74c8, Size=0x14) returned 0x45c9508
[0220.005] lstrlenW (lpString="Create") returned 6
[0220.005] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.005] _vsnwprintf (in: _Buffer=0x45c9508, _BufferCount=0x9, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|create|") returned 8
[0220.005] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x9, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|Create|") returned 8
[0220.005] lstrlenW (lpString="|create|") returned 8
[0220.005] lstrlenW (lpString="|Create|") returned 8
[0220.005] StrStrIW (lpFirst="|create|", lpSrch="|Create|") returned="|create|"
[0220.005] RtlRestoreLastWin32Error () returned 0x0
[0220.005] RtlRestoreLastWin32Error () returned 0x0
[0220.005] RtlRestoreLastWin32Error () returned 0x0
[0220.005] lstrlenW (lpString="/TN") returned 3
[0220.005] lstrlenW (lpString="-/") returned 2
[0220.005] StrChrIW (lpStart="-/", wMatch=0x445002f) returned="/"
[0220.005] lstrlenW (lpString="?") returned 1
[0220.005] lstrlenW (lpString="?") returned 1
[0220.005] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.005] lstrlenW (lpString="TN") returned 2
[0220.005] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.005] _vsnwprintf (in: _Buffer=0x45c9508, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|?|") returned 3
[0220.005] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|TN|") returned 4
[0220.006] lstrlenW (lpString="|?|") returned 3
[0220.006] lstrlenW (lpString="|TN|") returned 4
[0220.006] RtlRestoreLastWin32Error () returned 0x490
[0220.006] lstrlenW (lpString="create") returned 6
[0220.006] lstrlenW (lpString="create") returned 6
[0220.006] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.006] lstrlenW (lpString="TN") returned 2
[0220.006] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.006] _vsnwprintf (in: _Buffer=0x45c9508, _BufferCount=0x9, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|create|") returned 8
[0220.006] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|TN|") returned 4
[0220.006] lstrlenW (lpString="|create|") returned 8
[0220.006] lstrlenW (lpString="|TN|") returned 4
[0220.006] StrStrIW (lpFirst="|create|", lpSrch="|TN|") returned 0x0
[0220.006] RtlRestoreLastWin32Error () returned 0x490
[0220.006] lstrlenW (lpString="delete") returned 6
[0220.006] lstrlenW (lpString="delete") returned 6
[0220.006] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.006] lstrlenW (lpString="TN") returned 2
[0220.006] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.006] _vsnwprintf (in: _Buffer=0x45c9508, _BufferCount=0x9, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|delete|") returned 8
[0220.007] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|TN|") returned 4
[0220.007] lstrlenW (lpString="|delete|") returned 8
[0220.007] lstrlenW (lpString="|TN|") returned 4
[0220.007] StrStrIW (lpFirst="|delete|", lpSrch="|TN|") returned 0x0
[0220.007] RtlRestoreLastWin32Error () returned 0x490
[0220.007] lstrlenW (lpString="query") returned 5
[0220.007] lstrlenW (lpString="query") returned 5
[0220.007] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.007] lstrlenW (lpString="TN") returned 2
[0220.007] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.007] _vsnwprintf (in: _Buffer=0x45c9508, _BufferCount=0x8, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|query|") returned 7
[0220.007] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|TN|") returned 4
[0220.007] lstrlenW (lpString="|query|") returned 7
[0220.007] lstrlenW (lpString="|TN|") returned 4
[0220.007] StrStrIW (lpFirst="|query|", lpSrch="|TN|") returned 0x0
[0220.007] RtlRestoreLastWin32Error () returned 0x490
[0220.007] lstrlenW (lpString="change") returned 6
[0220.007] lstrlenW (lpString="change") returned 6
[0220.008] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.008] lstrlenW (lpString="TN") returned 2
[0220.008] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.008] _vsnwprintf (in: _Buffer=0x45c9508, _BufferCount=0x9, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|change|") returned 8
[0220.008] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|TN|") returned 4
[0220.008] lstrlenW (lpString="|change|") returned 8
[0220.008] lstrlenW (lpString="|TN|") returned 4
[0220.008] StrStrIW (lpFirst="|change|", lpSrch="|TN|") returned 0x0
[0220.008] RtlRestoreLastWin32Error () returned 0x490
[0220.008] lstrlenW (lpString="run") returned 3
[0220.008] lstrlenW (lpString="run") returned 3
[0220.008] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.008] lstrlenW (lpString="TN") returned 2
[0220.008] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.008] _vsnwprintf (in: _Buffer=0x45c9508, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|run|") returned 5
[0220.008] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|TN|") returned 4
[0220.008] lstrlenW (lpString="|run|") returned 5
[0220.008] lstrlenW (lpString="|TN|") returned 4
[0220.008] StrStrIW (lpFirst="|run|", lpSrch="|TN|") returned 0x0
[0220.008] RtlRestoreLastWin32Error () returned 0x490
[0220.008] lstrlenW (lpString="end") returned 3
[0220.008] lstrlenW (lpString="end") returned 3
[0220.008] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.008] lstrlenW (lpString="TN") returned 2
[0220.009] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.009] _vsnwprintf (in: _Buffer=0x45c9508, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|end|") returned 5
[0220.009] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|TN|") returned 4
[0220.009] lstrlenW (lpString="|end|") returned 5
[0220.009] lstrlenW (lpString="|TN|") returned 4
[0220.009] StrStrIW (lpFirst="|end|", lpSrch="|TN|") returned 0x0
[0220.009] RtlRestoreLastWin32Error () returned 0x490
[0220.009] lstrlenW (lpString="showsid") returned 7
[0220.009] lstrlenW (lpString="showsid") returned 7
[0220.009] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.009] GetProcessHeap () returned 0x45c0000
[0220.009] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9508) returned 1
[0220.009] GetProcessHeap () returned 0x45c0000
[0220.009] RtlReAllocateHeap (Heap=0x45c0000, Flags=0xc, Ptr=0x45c9508, Size=0x16) returned 0x45c9528
[0220.009] lstrlenW (lpString="TN") returned 2
[0220.009] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.009] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0xa, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|showsid|") returned 9
[0220.009] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|TN|") returned 4
[0220.009] lstrlenW (lpString="|showsid|") returned 9
[0220.009] lstrlenW (lpString="|TN|") returned 4
[0220.009] StrStrIW (lpFirst="|showsid|", lpSrch="|TN|") returned 0x0
[0220.009] RtlRestoreLastWin32Error () returned 0x490
[0220.009] RtlRestoreLastWin32Error () returned 0x490
[0220.009] RtlRestoreLastWin32Error () returned 0x0
[0220.009] lstrlenW (lpString="/TN") returned 3
[0220.010] StrChrIW (lpStart="/TN", wMatch=0x3a) returned 0x0
[0220.010] RtlRestoreLastWin32Error () returned 0x490
[0220.010] RtlRestoreLastWin32Error () returned 0x0
[0220.010] lstrlenW (lpString="/TN") returned 3
[0220.010] GetProcessHeap () returned 0x45c0000
[0220.010] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x8) returned 0x45c6c70
[0220.010] GetProcessHeap () returned 0x45c0000
[0220.010] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c9388
[0220.010] RtlRestoreLastWin32Error () returned 0x0
[0220.010] RtlRestoreLastWin32Error () returned 0x0
[0220.010] lstrlenW (lpString="Updates\\lyfhOEwABQlG") returned 20
[0220.010] lstrlenW (lpString="-/") returned 2
[0220.010] StrChrIW (lpStart="-/", wMatch=0x4450055) returned 0x0
[0220.010] RtlRestoreLastWin32Error () returned 0x490
[0220.010] RtlRestoreLastWin32Error () returned 0x490
[0220.010] RtlRestoreLastWin32Error () returned 0x0
[0220.010] lstrlenW (lpString="Updates\\lyfhOEwABQlG") returned 20
[0220.010] StrChrIW (lpStart="Updates\\lyfhOEwABQlG", wMatch=0x3a) returned 0x0
[0220.010] RtlRestoreLastWin32Error () returned 0x490
[0220.010] RtlRestoreLastWin32Error () returned 0x0
[0220.010] lstrlenW (lpString="Updates\\lyfhOEwABQlG") returned 20
[0220.010] GetProcessHeap () returned 0x45c0000
[0220.010] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x2a) returned 0x45c70d0
[0220.010] GetProcessHeap () returned 0x45c0000
[0220.010] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c9508
[0220.011] RtlRestoreLastWin32Error () returned 0x0
[0220.011] RtlRestoreLastWin32Error () returned 0x0
[0220.011] lstrlenW (lpString="/XML") returned 4
[0220.011] lstrlenW (lpString="-/") returned 2
[0220.011] StrChrIW (lpStart="-/", wMatch=0x445002f) returned="/"
[0220.011] lstrlenW (lpString="?") returned 1
[0220.011] lstrlenW (lpString="?") returned 1
[0220.011] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.011] lstrlenW (lpString="XML") returned 3
[0220.011] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.011] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|?|") returned 3
[0220.011] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|XML|") returned 5
[0220.011] lstrlenW (lpString="|?|") returned 3
[0220.011] lstrlenW (lpString="|XML|") returned 5
[0220.011] RtlRestoreLastWin32Error () returned 0x490
[0220.011] lstrlenW (lpString="create") returned 6
[0220.011] lstrlenW (lpString="create") returned 6
[0220.011] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.011] lstrlenW (lpString="XML") returned 3
[0220.011] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.011] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x9, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|create|") returned 8
[0220.011] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|XML|") returned 5
[0220.011] lstrlenW (lpString="|create|") returned 8
[0220.011] lstrlenW (lpString="|XML|") returned 5
[0220.012] StrStrIW (lpFirst="|create|", lpSrch="|XML|") returned 0x0
[0220.012] RtlRestoreLastWin32Error () returned 0x490
[0220.012] lstrlenW (lpString="delete") returned 6
[0220.012] lstrlenW (lpString="delete") returned 6
[0220.012] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.012] lstrlenW (lpString="XML") returned 3
[0220.012] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.012] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x9, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|delete|") returned 8
[0220.012] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|XML|") returned 5
[0220.012] lstrlenW (lpString="|delete|") returned 8
[0220.012] lstrlenW (lpString="|XML|") returned 5
[0220.012] StrStrIW (lpFirst="|delete|", lpSrch="|XML|") returned 0x0
[0220.012] RtlRestoreLastWin32Error () returned 0x490
[0220.012] lstrlenW (lpString="query") returned 5
[0220.012] lstrlenW (lpString="query") returned 5
[0220.012] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.012] lstrlenW (lpString="XML") returned 3
[0220.012] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.012] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x8, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|query|") returned 7
[0220.012] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|XML|") returned 5
[0220.012] lstrlenW (lpString="|query|") returned 7
[0220.013] lstrlenW (lpString="|XML|") returned 5
[0220.013] StrStrIW (lpFirst="|query|", lpSrch="|XML|") returned 0x0
[0220.013] RtlRestoreLastWin32Error () returned 0x490
[0220.013] lstrlenW (lpString="change") returned 6
[0220.013] lstrlenW (lpString="change") returned 6
[0220.013] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.013] lstrlenW (lpString="XML") returned 3
[0220.013] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.013] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x9, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|change|") returned 8
[0220.013] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|XML|") returned 5
[0220.013] lstrlenW (lpString="|change|") returned 8
[0220.013] lstrlenW (lpString="|XML|") returned 5
[0220.013] StrStrIW (lpFirst="|change|", lpSrch="|XML|") returned 0x0
[0220.013] RtlRestoreLastWin32Error () returned 0x490
[0220.013] lstrlenW (lpString="run") returned 3
[0220.013] lstrlenW (lpString="run") returned 3
[0220.013] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.013] lstrlenW (lpString="XML") returned 3
[0220.013] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.013] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|run|") returned 5
[0220.013] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|XML|") returned 5
[0220.013] lstrlenW (lpString="|run|") returned 5
[0220.013] lstrlenW (lpString="|XML|") returned 5
[0220.013] StrStrIW (lpFirst="|run|", lpSrch="|XML|") returned 0x0
[0220.013] RtlRestoreLastWin32Error () returned 0x490
[0220.013] lstrlenW (lpString="end") returned 3
[0220.013] lstrlenW (lpString="end") returned 3
[0220.014] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.014] lstrlenW (lpString="XML") returned 3
[0220.014] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.014] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|end|") returned 5
[0220.014] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|XML|") returned 5
[0220.014] lstrlenW (lpString="|end|") returned 5
[0220.014] lstrlenW (lpString="|XML|") returned 5
[0220.014] StrStrIW (lpFirst="|end|", lpSrch="|XML|") returned 0x0
[0220.014] RtlRestoreLastWin32Error () returned 0x490
[0220.014] lstrlenW (lpString="showsid") returned 7
[0220.014] lstrlenW (lpString="showsid") returned 7
[0220.014] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.014] lstrlenW (lpString="XML") returned 3
[0220.014] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.014] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0xa, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|showsid|") returned 9
[0220.014] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414fae0 | out: _Buffer="|XML|") returned 5
[0220.014] lstrlenW (lpString="|showsid|") returned 9
[0220.014] lstrlenW (lpString="|XML|") returned 5
[0220.014] StrStrIW (lpFirst="|showsid|", lpSrch="|XML|") returned 0x0
[0220.014] RtlRestoreLastWin32Error () returned 0x490
[0220.014] RtlRestoreLastWin32Error () returned 0x490
[0220.014] RtlRestoreLastWin32Error () returned 0x0
[0220.014] lstrlenW (lpString="/XML") returned 4
[0220.014] StrChrIW (lpStart="/XML", wMatch=0x3a) returned 0x0
[0220.014] RtlRestoreLastWin32Error () returned 0x490
[0220.014] RtlRestoreLastWin32Error () returned 0x0
[0220.014] lstrlenW (lpString="/XML") returned 4
[0220.014] GetProcessHeap () returned 0x45c0000
[0220.015] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0xa) returned 0x45c74c8
[0220.015] GetProcessHeap () returned 0x45c0000
[0220.015] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c9668
[0220.015] RtlRestoreLastWin32Error () returned 0x0
[0220.015] RtlRestoreLastWin32Error () returned 0x0
[0220.015] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp") returned 52
[0220.015] lstrlenW (lpString="-/") returned 2
[0220.015] StrChrIW (lpStart="-/", wMatch=0x4450043) returned 0x0
[0220.015] RtlRestoreLastWin32Error () returned 0x490
[0220.015] RtlRestoreLastWin32Error () returned 0x490
[0220.015] RtlRestoreLastWin32Error () returned 0x0
[0220.015] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp") returned 52
[0220.015] StrChrIW (lpStart="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp", wMatch=0x3a) returned=":\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp"
[0220.015] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp") returned 52
[0220.015] GetProcessHeap () returned 0x45c0000
[0220.015] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x10) returned 0x45c7378
[0220.015] _memicmp (_Buf1=0x45c7378, _Buf2=0x92708, _Size=0x7) returned 0
[0220.015] GetProcessHeap () returned 0x45c0000
[0220.015] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0xc) returned 0x45c7390
[0220.015] GetProcessHeap () returned 0x45c0000
[0220.015] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x10) returned 0x45cac10
[0220.015] _memicmp (_Buf1=0x45cac10, _Buf2=0x92708, _Size=0x7) returned 0
[0220.015] GetProcessHeap () returned 0x45c0000
[0220.015] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x6e) returned 0x45cada8
[0220.015] RtlRestoreLastWin32Error () returned 0x7a
[0220.015] RtlRestoreLastWin32Error () returned 0x0
[0220.015] RtlRestoreLastWin32Error () returned 0x0
[0220.015] lstrlenW (lpString="C") returned 1
[0220.015] RtlRestoreLastWin32Error () returned 0x490
[0220.016] RtlRestoreLastWin32Error () returned 0x0
[0220.016] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp") returned 52
[0220.016] GetProcessHeap () returned 0x45c0000
[0220.016] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x6a) returned 0x45cae20
[0220.016] GetProcessHeap () returned 0x45c0000
[0220.016] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c96a8
[0220.016] RtlRestoreLastWin32Error () returned 0x0
[0220.016] GetProcessHeap () returned 0x45c0000
[0220.016] GetProcessHeap () returned 0x45c0000
[0220.016] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c6c70) returned 1
[0220.016] GetProcessHeap () returned 0x45c0000
[0220.016] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c6c70) returned 0x8
[0220.016] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c6c70) returned 1
[0220.016] GetProcessHeap () returned 0x45c0000
[0220.016] GetProcessHeap () returned 0x45c0000
[0220.016] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9388) returned 1
[0220.016] GetProcessHeap () returned 0x45c0000
[0220.016] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9388) returned 0x14
[0220.016] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9388) returned 1
[0220.016] GetProcessHeap () returned 0x45c0000
[0220.016] GetProcessHeap () returned 0x45c0000
[0220.016] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c70d0) returned 1
[0220.016] GetProcessHeap () returned 0x45c0000
[0220.016] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c70d0) returned 0x2a
[0220.017] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c70d0) returned 1
[0220.017] GetProcessHeap () returned 0x45c0000
[0220.017] GetProcessHeap () returned 0x45c0000
[0220.017] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9508) returned 1
[0220.017] GetProcessHeap () returned 0x45c0000
[0220.017] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9508) returned 0x14
[0220.017] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9508) returned 1
[0220.017] GetProcessHeap () returned 0x45c0000
[0220.017] GetProcessHeap () returned 0x45c0000
[0220.017] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c74c8) returned 1
[0220.017] GetProcessHeap () returned 0x45c0000
[0220.017] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c74c8) returned 0xa
[0220.017] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c74c8) returned 1
[0220.018] GetProcessHeap () returned 0x45c0000
[0220.018] GetProcessHeap () returned 0x45c0000
[0220.018] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9668) returned 1
[0220.018] GetProcessHeap () returned 0x45c0000
[0220.018] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9668) returned 0x14
[0220.018] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9668) returned 1
[0220.018] GetProcessHeap () returned 0x45c0000
[0220.018] GetProcessHeap () returned 0x45c0000
[0220.018] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45cae20) returned 1
[0220.018] GetProcessHeap () returned 0x45c0000
[0220.018] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45cae20) returned 0x6a
[0220.018] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45cae20) returned 1
[0220.018] GetProcessHeap () returned 0x45c0000
[0220.019] GetProcessHeap () returned 0x45c0000
[0220.019] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c96a8) returned 1
[0220.019] GetProcessHeap () returned 0x45c0000
[0220.019] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c96a8) returned 0x14
[0220.019] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c96a8) returned 1
[0220.019] GetProcessHeap () returned 0x45c0000
[0220.019] GetProcessHeap () returned 0x45c0000
[0220.019] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c7438) returned 1
[0220.019] GetProcessHeap () returned 0x45c0000
[0220.019] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c7438) returned 0x10
[0220.019] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c7438) returned 1
[0220.019] RtlRestoreLastWin32Error () returned 0x0
[0220.019] VerSetConditionMask (ConditionMask=0x0, TypeMask=0x0, Condition=0x2) returned 0x18
[0220.019] VerSetConditionMask (ConditionMask=0x18, TypeMask=0x80000000, Condition=0x1) returned 0x1b
[0220.019] VerSetConditionMask (ConditionMask=0x1b, TypeMask=0x80000000, Condition=0x20) returned 0x1801b
[0220.020] RtlVerifyVersionInfo (VersionInfo=0x414ce60, TypeMask=0x3, ConditionMask=0x1801b) returned 0x0
[0220.020] RtlRestoreLastWin32Error () returned 0x0
[0220.020] lstrlenW (lpString="create") returned 6
[0220.020] StrChrIW (lpStart="create", wMatch=0x7c) returned 0x0
[0220.020] RtlRestoreLastWin32Error () returned 0x490
[0220.020] RtlRestoreLastWin32Error () returned 0x0
[0220.020] lstrlenW (lpString="create") returned 6
[0220.020] GetProcessHeap () returned 0x45c0000
[0220.020] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c9388
[0220.020] GetProcessHeap () returned 0x45c0000
[0220.020] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x10) returned 0x45ca9d0
[0220.020] _memicmp (_Buf1=0x45ca9d0, _Buf2=0x92708, _Size=0x7) returned 0
[0220.020] GetProcessHeap () returned 0x45c0000
[0220.020] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x16) returned 0x45c9508
[0220.020] RtlRestoreLastWin32Error () returned 0x0
[0220.020] _memicmp (_Buf1=0x45c74e0, _Buf2=0x92708, _Size=0x7) returned 0
[0220.020] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x45c8ce0, nSize=0x104 | out: lpFilename="C:\\Windows\\SysWOW64\\schtasks.exe" (normalized: "c:\\windows\\syswow64\\schtasks.exe")) returned 0x20
[0220.020] GetFileVersionInfoSizeExW (in: dwFlags=0x1, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", lpdwHandle=0x414cf6c | out: lpdwHandle=0x414cf6c) returned 0x76c
[0220.021] GetProcessHeap () returned 0x45c0000
[0220.021] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x776) returned 0x45c9db8
[0220.021] GetFileVersionInfoExW (in: dwFlags=0x3, lpwstrFilename="C:\\Windows\\SysWOW64\\schtasks.exe", dwHandle=0x0, dwLen=0x776, lpData=0x45c9db8 | out: lpData=0x45c9db8) returned 1
[0220.021] VerQueryValueW (in: pBlock=0x45c9db8, lpSubBlock="\\VarFileInfo\\Translation", lplpBuffer=0x414cf74, puLen=0x414cf78 | out: lplpBuffer=0x414cf74*=0x45ca168, puLen=0x414cf78) returned 1
[0220.021] _memicmp (_Buf1=0x45c74e0, _Buf2=0x92708, _Size=0x7) returned 0
[0220.021] _vsnwprintf (in: _Buffer=0x45c8ce0, _BufferCount=0x3f, _Format="\\StringFileInfo\\%04x%04x\\InternalName", _ArgList=0x414cf58 | out: _Buffer="\\StringFileInfo\\040904b0\\InternalName") returned 37
[0220.021] VerQueryValueW (in: pBlock=0x45c9db8, lpSubBlock="\\StringFileInfo\\040904b0\\InternalName", lplpBuffer=0x414cf84, puLen=0x414cf80 | out: lplpBuffer=0x414cf84*=0x45c9f98, puLen=0x414cf80) returned 1
[0220.021] lstrlenW (lpString="schtasks.exe") returned 12
[0220.021] lstrlenW (lpString="schtasks.exe") returned 12
[0220.021] lstrlenW (lpString=".EXE") returned 4
[0220.021] StrStrIW (lpFirst="schtasks.exe", lpSrch=".EXE") returned=".exe"
[0220.021] lstrlenW (lpString="schtasks.exe") returned 12
[0220.021] lstrlenW (lpString=".EXE") returned 4
[0220.021] lstrlenW (lpString="schtasks") returned 8
[0220.021] lstrlenW (lpString="/create") returned 7
[0220.021] _memicmp (_Buf1=0x45c74e0, _Buf2=0x92708, _Size=0x7) returned 0
[0220.021] _vsnwprintf (in: _Buffer=0x45c8ce0, _BufferCount=0x19, _Format="%s %s", _ArgList=0x414cf58 | out: _Buffer="schtasks /create") returned 16
[0220.021] _memicmp (_Buf1=0x45c7498, _Buf2=0x92708, _Size=0x7) returned 0
[0220.021] GetProcessHeap () returned 0x45c0000
[0220.021] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45c9548
[0220.021] _memicmp (_Buf1=0x45c73f0, _Buf2=0x92708, _Size=0x7) returned 0
[0220.021] LoadStringW (in: hInstance=0x0, uID=0x15ed, lpBuffer=0x45ca798, cchBufferMax=256 | out: lpBuffer="Type \"%s /?\" for usage.") returned 0x17
[0220.021] lstrlenW (lpString="Type \"%s /?\" for usage.") returned 23
[0220.021] GetProcessHeap () returned 0x45c0000
[0220.022] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x30) returned 0x45c70d0
[0220.022] _vsnwprintf (in: _Buffer=0x45c69e0, _BufferCount=0x4f, _Format="Type \"%s /?\" for usage.", _ArgList=0x414cf5c | out: _Buffer="Type \"SCHTASKS /CREATE /?\" for usage.") returned 37
[0220.022] GetProcessHeap () returned 0x45c0000
[0220.022] GetProcessHeap () returned 0x45c0000
[0220.022] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9db8) returned 1
[0220.022] GetProcessHeap () returned 0x45c0000
[0220.022] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9db8) returned 0x776
[0220.022] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9db8) returned 1
[0220.022] RtlRestoreLastWin32Error () returned 0x0
[0220.022] GetThreadLocale () returned 0x409
[0220.022] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.022] lstrlenW (lpString="create") returned 6
[0220.023] GetThreadLocale () returned 0x409
[0220.023] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.023] lstrlenW (lpString="?") returned 1
[0220.023] GetThreadLocale () returned 0x409
[0220.023] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.023] lstrlenW (lpString="s") returned 1
[0220.023] GetThreadLocale () returned 0x409
[0220.023] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.023] lstrlenW (lpString="u") returned 1
[0220.023] GetThreadLocale () returned 0x409
[0220.023] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.023] lstrlenW (lpString="p") returned 1
[0220.023] GetThreadLocale () returned 0x409
[0220.023] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.023] lstrlenW (lpString="ru") returned 2
[0220.023] GetThreadLocale () returned 0x409
[0220.023] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.023] lstrlenW (lpString="rp") returned 2
[0220.023] GetThreadLocale () returned 0x409
[0220.023] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.023] lstrlenW (lpString="sc") returned 2
[0220.023] GetThreadLocale () returned 0x409
[0220.023] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.023] lstrlenW (lpString="mo") returned 2
[0220.023] GetThreadLocale () returned 0x409
[0220.023] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.023] lstrlenW (lpString="d") returned 1
[0220.023] GetThreadLocale () returned 0x409
[0220.023] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.023] lstrlenW (lpString="m") returned 1
[0220.023] GetThreadLocale () returned 0x409
[0220.023] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.023] lstrlenW (lpString="i") returned 1
[0220.023] GetThreadLocale () returned 0x409
[0220.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.024] lstrlenW (lpString="tn") returned 2
[0220.024] GetThreadLocale () returned 0x409
[0220.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.024] lstrlenW (lpString="tr") returned 2
[0220.024] GetThreadLocale () returned 0x409
[0220.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.024] lstrlenW (lpString="st") returned 2
[0220.024] GetThreadLocale () returned 0x409
[0220.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.024] lstrlenW (lpString="sd") returned 2
[0220.024] GetThreadLocale () returned 0x409
[0220.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.024] lstrlenW (lpString="ed") returned 2
[0220.024] GetThreadLocale () returned 0x409
[0220.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.024] lstrlenW (lpString="it") returned 2
[0220.024] GetThreadLocale () returned 0x409
[0220.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.024] lstrlenW (lpString="et") returned 2
[0220.024] GetThreadLocale () returned 0x409
[0220.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.024] lstrlenW (lpString="k") returned 1
[0220.024] GetThreadLocale () returned 0x409
[0220.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.024] lstrlenW (lpString="du") returned 2
[0220.024] GetThreadLocale () returned 0x409
[0220.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.024] lstrlenW (lpString="ri") returned 2
[0220.024] GetThreadLocale () returned 0x409
[0220.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.024] lstrlenW (lpString="z") returned 1
[0220.024] GetThreadLocale () returned 0x409
[0220.024] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.024] lstrlenW (lpString="f") returned 1
[0220.024] GetThreadLocale () returned 0x409
[0220.025] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.025] lstrlenW (lpString="v1") returned 2
[0220.025] GetThreadLocale () returned 0x409
[0220.025] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.025] lstrlenW (lpString="xml") returned 3
[0220.025] GetThreadLocale () returned 0x409
[0220.025] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.025] lstrlenW (lpString="ec") returned 2
[0220.025] GetThreadLocale () returned 0x409
[0220.025] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.025] lstrlenW (lpString="rl") returned 2
[0220.025] GetThreadLocale () returned 0x409
[0220.025] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.025] lstrlenW (lpString="delay") returned 5
[0220.025] GetThreadLocale () returned 0x409
[0220.025] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.025] lstrlenW (lpString="np") returned 2
[0220.025] GetThreadLocale () returned 0x409
[0220.025] CompareStringA (Locale=0x409, dwCmpFlags=0x1, lpString1="PARSER2", cchCount1=-1, lpString2="PARSER2", cchCount2=-1) returned 2
[0220.025] lstrlenW (lpString="hresult") returned 7
[0220.025] RtlRestoreLastWin32Error () returned 0x0
[0220.025] RtlRestoreLastWin32Error () returned 0x0
[0220.025] lstrlenW (lpString="/Create") returned 7
[0220.025] lstrlenW (lpString="-/") returned 2
[0220.025] StrChrIW (lpStart="-/", wMatch=0x445002f) returned="/"
[0220.025] lstrlenW (lpString="create") returned 6
[0220.025] lstrlenW (lpString="create") returned 6
[0220.025] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.025] lstrlenW (lpString="Create") returned 6
[0220.025] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.025] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x9, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|create|") returned 8
[0220.025] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x9, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|Create|") returned 8
[0220.025] lstrlenW (lpString="|create|") returned 8
[0220.025] lstrlenW (lpString="|Create|") returned 8
[0220.026] StrStrIW (lpFirst="|create|", lpSrch="|Create|") returned="|create|"
[0220.026] RtlRestoreLastWin32Error () returned 0x0
[0220.026] RtlRestoreLastWin32Error () returned 0x0
[0220.026] RtlRestoreLastWin32Error () returned 0x0
[0220.026] lstrlenW (lpString="/TN") returned 3
[0220.026] lstrlenW (lpString="-/") returned 2
[0220.026] StrChrIW (lpStart="-/", wMatch=0x445002f) returned="/"
[0220.026] lstrlenW (lpString="create") returned 6
[0220.026] lstrlenW (lpString="create") returned 6
[0220.026] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.026] lstrlenW (lpString="TN") returned 2
[0220.026] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.026] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x9, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|create|") returned 8
[0220.026] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|TN|") returned 4
[0220.026] lstrlenW (lpString="|create|") returned 8
[0220.026] lstrlenW (lpString="|TN|") returned 4
[0220.026] StrStrIW (lpFirst="|create|", lpSrch="|TN|") returned 0x0
[0220.026] RtlRestoreLastWin32Error () returned 0x490
[0220.026] lstrlenW (lpString="?") returned 1
[0220.026] lstrlenW (lpString="?") returned 1
[0220.026] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.026] lstrlenW (lpString="TN") returned 2
[0220.026] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.026] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|?|") returned 3
[0220.026] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|TN|") returned 4
[0220.026] lstrlenW (lpString="|?|") returned 3
[0220.026] lstrlenW (lpString="|TN|") returned 4
[0220.026] RtlRestoreLastWin32Error () returned 0x490
[0220.026] lstrlenW (lpString="s") returned 1
[0220.026] lstrlenW (lpString="s") returned 1
[0220.026] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.026] lstrlenW (lpString="TN") returned 2
[0220.027] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.027] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|s|") returned 3
[0220.027] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|TN|") returned 4
[0220.027] lstrlenW (lpString="|s|") returned 3
[0220.027] lstrlenW (lpString="|TN|") returned 4
[0220.027] RtlRestoreLastWin32Error () returned 0x490
[0220.027] lstrlenW (lpString="u") returned 1
[0220.027] lstrlenW (lpString="u") returned 1
[0220.027] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.027] lstrlenW (lpString="TN") returned 2
[0220.027] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.027] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|u|") returned 3
[0220.027] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|TN|") returned 4
[0220.027] lstrlenW (lpString="|u|") returned 3
[0220.027] lstrlenW (lpString="|TN|") returned 4
[0220.027] RtlRestoreLastWin32Error () returned 0x490
[0220.027] lstrlenW (lpString="p") returned 1
[0220.027] lstrlenW (lpString="p") returned 1
[0220.027] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.027] lstrlenW (lpString="TN") returned 2
[0220.027] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.027] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|p|") returned 3
[0220.027] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|TN|") returned 4
[0220.027] lstrlenW (lpString="|p|") returned 3
[0220.027] lstrlenW (lpString="|TN|") returned 4
[0220.027] RtlRestoreLastWin32Error () returned 0x490
[0220.027] lstrlenW (lpString="ru") returned 2
[0220.027] lstrlenW (lpString="ru") returned 2
[0220.027] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.027] lstrlenW (lpString="TN") returned 2
[0220.027] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.028] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|ru|") returned 4
[0220.028] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|TN|") returned 4
[0220.028] lstrlenW (lpString="|ru|") returned 4
[0220.028] lstrlenW (lpString="|TN|") returned 4
[0220.028] StrStrIW (lpFirst="|ru|", lpSrch="|TN|") returned 0x0
[0220.028] RtlRestoreLastWin32Error () returned 0x490
[0220.028] lstrlenW (lpString="rp") returned 2
[0220.028] lstrlenW (lpString="rp") returned 2
[0220.028] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.028] lstrlenW (lpString="TN") returned 2
[0220.028] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.028] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|rp|") returned 4
[0220.028] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|TN|") returned 4
[0220.028] lstrlenW (lpString="|rp|") returned 4
[0220.028] lstrlenW (lpString="|TN|") returned 4
[0220.028] StrStrIW (lpFirst="|rp|", lpSrch="|TN|") returned 0x0
[0220.028] RtlRestoreLastWin32Error () returned 0x490
[0220.028] lstrlenW (lpString="sc") returned 2
[0220.028] lstrlenW (lpString="sc") returned 2
[0220.028] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.028] lstrlenW (lpString="TN") returned 2
[0220.028] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.028] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|sc|") returned 4
[0220.028] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|TN|") returned 4
[0220.028] lstrlenW (lpString="|sc|") returned 4
[0220.028] lstrlenW (lpString="|TN|") returned 4
[0220.028] StrStrIW (lpFirst="|sc|", lpSrch="|TN|") returned 0x0
[0220.028] RtlRestoreLastWin32Error () returned 0x490
[0220.028] lstrlenW (lpString="mo") returned 2
[0220.028] lstrlenW (lpString="mo") returned 2
[0220.029] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.029] lstrlenW (lpString="TN") returned 2
[0220.029] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.029] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|mo|") returned 4
[0220.029] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|TN|") returned 4
[0220.029] lstrlenW (lpString="|mo|") returned 4
[0220.029] lstrlenW (lpString="|TN|") returned 4
[0220.029] StrStrIW (lpFirst="|mo|", lpSrch="|TN|") returned 0x0
[0220.029] RtlRestoreLastWin32Error () returned 0x490
[0220.029] lstrlenW (lpString="d") returned 1
[0220.029] lstrlenW (lpString="d") returned 1
[0220.029] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.029] lstrlenW (lpString="TN") returned 2
[0220.029] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.029] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|d|") returned 3
[0220.029] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|TN|") returned 4
[0220.029] lstrlenW (lpString="|d|") returned 3
[0220.029] lstrlenW (lpString="|TN|") returned 4
[0220.029] RtlRestoreLastWin32Error () returned 0x490
[0220.029] lstrlenW (lpString="m") returned 1
[0220.029] lstrlenW (lpString="m") returned 1
[0220.029] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.029] lstrlenW (lpString="TN") returned 2
[0220.029] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.029] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|m|") returned 3
[0220.029] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|TN|") returned 4
[0220.029] lstrlenW (lpString="|m|") returned 3
[0220.029] lstrlenW (lpString="|TN|") returned 4
[0220.029] RtlRestoreLastWin32Error () returned 0x490
[0220.029] lstrlenW (lpString="i") returned 1
[0220.029] lstrlenW (lpString="i") returned 1
[0220.029] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.030] lstrlenW (lpString="TN") returned 2
[0220.030] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.030] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|i|") returned 3
[0220.030] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|TN|") returned 4
[0220.030] lstrlenW (lpString="|i|") returned 3
[0220.030] lstrlenW (lpString="|TN|") returned 4
[0220.030] RtlRestoreLastWin32Error () returned 0x490
[0220.030] lstrlenW (lpString="tn") returned 2
[0220.030] lstrlenW (lpString="tn") returned 2
[0220.030] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.030] lstrlenW (lpString="TN") returned 2
[0220.030] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.030] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|tn|") returned 4
[0220.030] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|TN|") returned 4
[0220.030] lstrlenW (lpString="|tn|") returned 4
[0220.030] lstrlenW (lpString="|TN|") returned 4
[0220.030] StrStrIW (lpFirst="|tn|", lpSrch="|TN|") returned="|tn|"
[0220.030] RtlRestoreLastWin32Error () returned 0x0
[0220.030] RtlRestoreLastWin32Error () returned 0x0
[0220.030] lstrlenW (lpString="Updates\\lyfhOEwABQlG") returned 20
[0220.030] lstrlenW (lpString="-/") returned 2
[0220.030] StrChrIW (lpStart="-/", wMatch=0x4450055) returned 0x0
[0220.030] RtlRestoreLastWin32Error () returned 0x490
[0220.030] RtlRestoreLastWin32Error () returned 0x490
[0220.030] RtlRestoreLastWin32Error () returned 0x0
[0220.030] lstrlenW (lpString="Updates\\lyfhOEwABQlG") returned 20
[0220.030] StrChrIW (lpStart="Updates\\lyfhOEwABQlG", wMatch=0x3a) returned 0x0
[0220.030] RtlRestoreLastWin32Error () returned 0x490
[0220.030] RtlRestoreLastWin32Error () returned 0x0
[0220.030] lstrlenW (lpString="Updates\\lyfhOEwABQlG") returned 20
[0220.030] RtlRestoreLastWin32Error () returned 0x0
[0220.030] RtlRestoreLastWin32Error () returned 0x0
[0220.030] lstrlenW (lpString="/XML") returned 4
[0220.030] lstrlenW (lpString="-/") returned 2
[0220.031] StrChrIW (lpStart="-/", wMatch=0x445002f) returned="/"
[0220.031] lstrlenW (lpString="create") returned 6
[0220.031] lstrlenW (lpString="create") returned 6
[0220.031] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.031] lstrlenW (lpString="XML") returned 3
[0220.031] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.031] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x9, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|create|") returned 8
[0220.031] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.031] lstrlenW (lpString="|create|") returned 8
[0220.031] lstrlenW (lpString="|XML|") returned 5
[0220.031] StrStrIW (lpFirst="|create|", lpSrch="|XML|") returned 0x0
[0220.031] RtlRestoreLastWin32Error () returned 0x490
[0220.031] lstrlenW (lpString="?") returned 1
[0220.031] lstrlenW (lpString="?") returned 1
[0220.031] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.031] lstrlenW (lpString="XML") returned 3
[0220.031] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.031] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|?|") returned 3
[0220.031] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.031] lstrlenW (lpString="|?|") returned 3
[0220.031] lstrlenW (lpString="|XML|") returned 5
[0220.031] RtlRestoreLastWin32Error () returned 0x490
[0220.031] lstrlenW (lpString="s") returned 1
[0220.031] lstrlenW (lpString="s") returned 1
[0220.031] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.032] lstrlenW (lpString="XML") returned 3
[0220.032] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.032] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|s|") returned 3
[0220.032] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.032] lstrlenW (lpString="|s|") returned 3
[0220.032] lstrlenW (lpString="|XML|") returned 5
[0220.032] RtlRestoreLastWin32Error () returned 0x490
[0220.032] lstrlenW (lpString="u") returned 1
[0220.032] lstrlenW (lpString="u") returned 1
[0220.032] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.032] lstrlenW (lpString="XML") returned 3
[0220.032] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.032] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|u|") returned 3
[0220.032] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.032] lstrlenW (lpString="|u|") returned 3
[0220.032] lstrlenW (lpString="|XML|") returned 5
[0220.032] RtlRestoreLastWin32Error () returned 0x490
[0220.032] lstrlenW (lpString="p") returned 1
[0220.032] lstrlenW (lpString="p") returned 1
[0220.032] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.032] lstrlenW (lpString="XML") returned 3
[0220.032] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.032] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|p|") returned 3
[0220.032] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.032] lstrlenW (lpString="|p|") returned 3
[0220.032] lstrlenW (lpString="|XML|") returned 5
[0220.032] RtlRestoreLastWin32Error () returned 0x490
[0220.032] lstrlenW (lpString="ru") returned 2
[0220.032] lstrlenW (lpString="ru") returned 2
[0220.032] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.032] lstrlenW (lpString="XML") returned 3
[0220.033] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.033] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|ru|") returned 4
[0220.033] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.033] lstrlenW (lpString="|ru|") returned 4
[0220.033] lstrlenW (lpString="|XML|") returned 5
[0220.033] RtlRestoreLastWin32Error () returned 0x490
[0220.033] lstrlenW (lpString="rp") returned 2
[0220.033] lstrlenW (lpString="rp") returned 2
[0220.033] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.033] lstrlenW (lpString="XML") returned 3
[0220.033] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.076] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|rp|") returned 4
[0220.076] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.076] lstrlenW (lpString="|rp|") returned 4
[0220.077] lstrlenW (lpString="|XML|") returned 5
[0220.077] RtlRestoreLastWin32Error () returned 0x490
[0220.077] lstrlenW (lpString="sc") returned 2
[0220.077] lstrlenW (lpString="sc") returned 2
[0220.077] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.077] lstrlenW (lpString="XML") returned 3
[0220.077] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.077] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|sc|") returned 4
[0220.077] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.077] lstrlenW (lpString="|sc|") returned 4
[0220.077] lstrlenW (lpString="|XML|") returned 5
[0220.077] RtlRestoreLastWin32Error () returned 0x490
[0220.077] lstrlenW (lpString="mo") returned 2
[0220.077] lstrlenW (lpString="mo") returned 2
[0220.077] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.077] lstrlenW (lpString="XML") returned 3
[0220.077] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.077] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|mo|") returned 4
[0220.077] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.077] lstrlenW (lpString="|mo|") returned 4
[0220.077] lstrlenW (lpString="|XML|") returned 5
[0220.077] RtlRestoreLastWin32Error () returned 0x490
[0220.077] lstrlenW (lpString="d") returned 1
[0220.077] lstrlenW (lpString="d") returned 1
[0220.077] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.077] lstrlenW (lpString="XML") returned 3
[0220.077] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.077] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|d|") returned 3
[0220.077] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.078] lstrlenW (lpString="|d|") returned 3
[0220.078] lstrlenW (lpString="|XML|") returned 5
[0220.078] RtlRestoreLastWin32Error () returned 0x490
[0220.078] lstrlenW (lpString="m") returned 1
[0220.078] lstrlenW (lpString="m") returned 1
[0220.078] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.078] lstrlenW (lpString="XML") returned 3
[0220.078] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.078] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|m|") returned 3
[0220.078] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.078] lstrlenW (lpString="|m|") returned 3
[0220.078] lstrlenW (lpString="|XML|") returned 5
[0220.078] RtlRestoreLastWin32Error () returned 0x490
[0220.078] lstrlenW (lpString="i") returned 1
[0220.078] lstrlenW (lpString="i") returned 1
[0220.078] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.078] lstrlenW (lpString="XML") returned 3
[0220.078] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.078] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|i|") returned 3
[0220.078] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.078] lstrlenW (lpString="|i|") returned 3
[0220.078] lstrlenW (lpString="|XML|") returned 5
[0220.078] RtlRestoreLastWin32Error () returned 0x490
[0220.078] lstrlenW (lpString="tn") returned 2
[0220.078] lstrlenW (lpString="tn") returned 2
[0220.078] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.078] lstrlenW (lpString="XML") returned 3
[0220.078] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.079] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|tn|") returned 4
[0220.079] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.079] lstrlenW (lpString="|tn|") returned 4
[0220.079] lstrlenW (lpString="|XML|") returned 5
[0220.079] RtlRestoreLastWin32Error () returned 0x490
[0220.079] lstrlenW (lpString="tr") returned 2
[0220.079] lstrlenW (lpString="tr") returned 2
[0220.079] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.079] lstrlenW (lpString="XML") returned 3
[0220.079] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.079] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|tr|") returned 4
[0220.079] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.079] lstrlenW (lpString="|tr|") returned 4
[0220.079] lstrlenW (lpString="|XML|") returned 5
[0220.079] RtlRestoreLastWin32Error () returned 0x490
[0220.079] lstrlenW (lpString="st") returned 2
[0220.079] lstrlenW (lpString="st") returned 2
[0220.079] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.079] lstrlenW (lpString="XML") returned 3
[0220.079] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.079] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|st|") returned 4
[0220.079] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.079] lstrlenW (lpString="|st|") returned 4
[0220.079] lstrlenW (lpString="|XML|") returned 5
[0220.079] RtlRestoreLastWin32Error () returned 0x490
[0220.079] lstrlenW (lpString="sd") returned 2
[0220.079] lstrlenW (lpString="sd") returned 2
[0220.079] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.079] lstrlenW (lpString="XML") returned 3
[0220.079] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.079] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|sd|") returned 4
[0220.080] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.080] lstrlenW (lpString="|sd|") returned 4
[0220.080] lstrlenW (lpString="|XML|") returned 5
[0220.080] RtlRestoreLastWin32Error () returned 0x490
[0220.080] lstrlenW (lpString="ed") returned 2
[0220.080] lstrlenW (lpString="ed") returned 2
[0220.080] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.080] lstrlenW (lpString="XML") returned 3
[0220.080] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.080] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|ed|") returned 4
[0220.080] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.080] lstrlenW (lpString="|ed|") returned 4
[0220.080] lstrlenW (lpString="|XML|") returned 5
[0220.080] RtlRestoreLastWin32Error () returned 0x490
[0220.080] lstrlenW (lpString="it") returned 2
[0220.080] lstrlenW (lpString="it") returned 2
[0220.080] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.080] lstrlenW (lpString="XML") returned 3
[0220.080] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.080] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|it|") returned 4
[0220.080] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.080] lstrlenW (lpString="|it|") returned 4
[0220.080] lstrlenW (lpString="|XML|") returned 5
[0220.080] RtlRestoreLastWin32Error () returned 0x490
[0220.080] lstrlenW (lpString="et") returned 2
[0220.080] lstrlenW (lpString="et") returned 2
[0220.080] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.080] lstrlenW (lpString="XML") returned 3
[0220.080] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.080] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|et|") returned 4
[0220.080] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.080] lstrlenW (lpString="|et|") returned 4
[0220.081] lstrlenW (lpString="|XML|") returned 5
[0220.081] RtlRestoreLastWin32Error () returned 0x490
[0220.081] lstrlenW (lpString="k") returned 1
[0220.081] lstrlenW (lpString="k") returned 1
[0220.081] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.081] lstrlenW (lpString="XML") returned 3
[0220.081] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.081] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|k|") returned 3
[0220.081] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.081] lstrlenW (lpString="|k|") returned 3
[0220.081] lstrlenW (lpString="|XML|") returned 5
[0220.081] RtlRestoreLastWin32Error () returned 0x490
[0220.081] lstrlenW (lpString="du") returned 2
[0220.081] lstrlenW (lpString="du") returned 2
[0220.081] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.081] lstrlenW (lpString="XML") returned 3
[0220.081] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.081] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|du|") returned 4
[0220.081] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.081] lstrlenW (lpString="|du|") returned 4
[0220.081] lstrlenW (lpString="|XML|") returned 5
[0220.081] RtlRestoreLastWin32Error () returned 0x490
[0220.081] lstrlenW (lpString="ri") returned 2
[0220.081] lstrlenW (lpString="ri") returned 2
[0220.081] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.081] lstrlenW (lpString="XML") returned 3
[0220.081] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.081] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|ri|") returned 4
[0220.081] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.081] lstrlenW (lpString="|ri|") returned 4
[0220.081] lstrlenW (lpString="|XML|") returned 5
[0220.082] RtlRestoreLastWin32Error () returned 0x490
[0220.082] lstrlenW (lpString="z") returned 1
[0220.082] lstrlenW (lpString="z") returned 1
[0220.082] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.082] lstrlenW (lpString="XML") returned 3
[0220.082] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.082] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|z|") returned 3
[0220.082] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.082] lstrlenW (lpString="|z|") returned 3
[0220.082] lstrlenW (lpString="|XML|") returned 5
[0220.082] RtlRestoreLastWin32Error () returned 0x490
[0220.082] lstrlenW (lpString="f") returned 1
[0220.082] lstrlenW (lpString="f") returned 1
[0220.082] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.082] lstrlenW (lpString="XML") returned 3
[0220.082] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.082] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x4, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|f|") returned 3
[0220.082] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.082] lstrlenW (lpString="|f|") returned 3
[0220.082] lstrlenW (lpString="|XML|") returned 5
[0220.082] RtlRestoreLastWin32Error () returned 0x490
[0220.082] lstrlenW (lpString="v1") returned 2
[0220.082] lstrlenW (lpString="v1") returned 2
[0220.082] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.082] lstrlenW (lpString="XML") returned 3
[0220.082] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.083] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x5, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|v1|") returned 4
[0220.083] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.083] lstrlenW (lpString="|v1|") returned 4
[0220.083] lstrlenW (lpString="|XML|") returned 5
[0220.083] RtlRestoreLastWin32Error () returned 0x490
[0220.083] lstrlenW (lpString="xml") returned 3
[0220.083] lstrlenW (lpString="xml") returned 3
[0220.083] _memicmp (_Buf1=0x45c73a8, _Buf2=0x92708, _Size=0x7) returned 0
[0220.083] lstrlenW (lpString="XML") returned 3
[0220.083] _memicmp (_Buf1=0x45c7408, _Buf2=0x92708, _Size=0x7) returned 0
[0220.083] _vsnwprintf (in: _Buffer=0x45c9528, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|xml|") returned 5
[0220.083] _vsnwprintf (in: _Buffer=0x45c94a8, _BufferCount=0x6, _Format="|%s|", _ArgList=0x414cf48 | out: _Buffer="|XML|") returned 5
[0220.083] lstrlenW (lpString="|xml|") returned 5
[0220.083] lstrlenW (lpString="|XML|") returned 5
[0220.083] StrStrIW (lpFirst="|xml|", lpSrch="|XML|") returned="|xml|"
[0220.083] RtlRestoreLastWin32Error () returned 0x0
[0220.083] RtlRestoreLastWin32Error () returned 0x0
[0220.083] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp") returned 52
[0220.083] lstrlenW (lpString="-/") returned 2
[0220.083] StrChrIW (lpStart="-/", wMatch=0x4450043) returned 0x0
[0220.083] RtlRestoreLastWin32Error () returned 0x490
[0220.083] RtlRestoreLastWin32Error () returned 0x490
[0220.083] RtlRestoreLastWin32Error () returned 0x0
[0220.083] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp") returned 52
[0220.083] StrChrIW (lpStart="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp", wMatch=0x3a) returned=":\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp"
[0220.083] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp") returned 52
[0220.083] _memicmp (_Buf1=0x45c7378, _Buf2=0x92708, _Size=0x7) returned 0
[0220.083] _memicmp (_Buf1=0x45cac10, _Buf2=0x92708, _Size=0x7) returned 0
[0220.083] RtlRestoreLastWin32Error () returned 0x7a
[0220.087] RtlRestoreLastWin32Error () returned 0x0
[0220.087] RtlRestoreLastWin32Error () returned 0x0
[0220.087] lstrlenW (lpString="C") returned 1
[0220.087] RtlRestoreLastWin32Error () returned 0x490
[0220.087] RtlRestoreLastWin32Error () returned 0x0
[0220.087] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp") returned 52
[0220.087] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp") returned 52
[0220.088] GetProcessHeap () returned 0x45c0000
[0220.088] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x6a) returned 0x45cae20
[0220.088] RtlRestoreLastWin32Error () returned 0x0
[0220.088] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp") returned 52
[0220.088] RtlRestoreLastWin32Error () returned 0x0
[0220.088] GetProcessHeap () returned 0x45c0000
[0220.088] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x1fc) returned 0x45c9db8
[0220.088] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0220.097] CoInitializeSecurity (pSecDesc=0x0, cAuthSvc=-1, asAuthSvc=0x0, pReserved1=0x0, dwAuthnLevel=0x1, dwImpLevel=0x3, pAuthList=0x0, dwCapabilities=0x0, pReserved3=0x0) returned 0x0
[0220.133] CoCreateInstance (in: rclsid=0x926c0*(Data1=0xf87369f, Data2=0xa4e5, Data3=0x4cfc, Data4=([0]=0xbd, [1]=0x3e, [2]=0x73, [3]=0xe6, [4]=0x15, [5]=0x45, [6]=0x72, [7]=0xdd)), pUnkOuter=0x0, dwClsContext=0x17, riid=0x926d0*(Data1=0x2faba4c7, Data2=0x4da9, Data3=0x4013, Data4=([0]=0x96, [1]=0x97, [2]=0x20, [3]=0xcc, [4]=0x3f, [5]=0xd4, [6]=0xf, [7]=0x85)), ppv=0x414d39c | out: ppv=0x414d39c*=0x4453758) returned 0x0
[0220.494] TaskScheduler:ITaskService:Connect (This=0x4453758, serverName=0x414d34c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), user=0x414d35c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), domain=0x414d36c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), password=0x414d37c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0)) returned 0x0
[0220.551] TaskScheduler:ITaskService:GetFolder (in: This=0x4453758, Path=0x0, ppFolder=0x414d464 | out: ppFolder=0x414d464*=0x4453880) returned 0x0
[0220.556] CreateFileW (lpFileName="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\temp\\tmp5e17.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x5, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x8000080, hTemplateFile=0x0) returned 0x128
[0220.557] GetFileSizeEx (in: hFile=0x128, lpFileSize=0x414cd7c | out: lpFileSize=0x414cd7c*=1600) returned 1
[0220.557] ReadFile (in: hFile=0x128, lpBuffer=0x414cd8c, nNumberOfBytesToRead=0x2, lpNumberOfBytesRead=0x414cd88, lpOverlapped=0x0 | out: lpBuffer=0x414cd8c*, lpNumberOfBytesRead=0x414cd88*=0x2, lpOverlapped=0x0) returned 1
[0220.558] SetFilePointer (in: hFile=0x128, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x0 | out: lpDistanceToMoveHigh=0x0) returned 0x0
[0220.558] malloc (_Size=0x641) returned 0x44538d0
[0220.558] ReadFile (in: hFile=0x128, lpBuffer=0x44538d0, nNumberOfBytesToRead=0x641, lpNumberOfBytesRead=0x414cd88, lpOverlapped=0x0 | out: lpBuffer=0x44538d0*, lpNumberOfBytesRead=0x414cd88*=0x640, lpOverlapped=0x0) returned 1
[0220.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x44538d0, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 1601
[0220.558] MultiByteToWideChar (in: CodePage=0x3, dwFlags=0x0, lpMultiByteStr=0x44538d0, cbMultiByte=-1, lpWideCharStr=0x45daafc, cchWideChar=1601 | out: lpWideCharStr="\n\n \n 2014-10-25T14:27:44.8929027\n XC64ZB\\RDhJ0CNFevzX\n \n \n \n true\n XC64ZB\\RDhJ0CNFevzX\n \n \n false\n \n \n \n \n XC64ZB\\RDhJ0CNFevzX\n InteractiveToken\n LeastPrivilege\n \n \n \n StopExisting\n false\n true\n false\n true\n false\n \n true\n false\n \n true\n true\n false\n false\n false\n PT0S\n 7\n \n \n \n C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe\n \n \n") returned 1601
[0220.558] SysStringLen (param_1="\n\n \n 2014-10-25T14:27:44.8929027\n XC64ZB\\RDhJ0CNFevzX\n \n \n \n true\n XC64ZB\\RDhJ0CNFevzX\n \n \n false\n \n \n \n \n XC64ZB\\RDhJ0CNFevzX\n InteractiveToken\n LeastPrivilege\n \n \n \n StopExisting\n false\n true\n false\n true\n false\n \n true\n false\n \n true\n true\n false\n false\n false\n PT0S\n 7\n \n \n \n C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe\n \n \n") returned 0x640
[0220.558] VarBstrCat (in: bstrLeft=0x0, bstrRight="\n\n \n 2014-10-25T14:27:44.8929027\n XC64ZB\\RDhJ0CNFevzX\n \n \n \n true\n XC64ZB\\RDhJ0CNFevzX\n \n \n false\n \n \n \n \n XC64ZB\\RDhJ0CNFevzX\n InteractiveToken\n LeastPrivilege\n \n \n \n StopExisting\n false\n true\n false\n true\n false\n \n true\n false\n \n true\n true\n false\n false\n false\n PT0S\n 7\n \n \n \n C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe\n \n \n", pbstrResult=0x414cd2c | out: pbstrResult=0x414cd2c) returned 0x0
[0220.559] free (_Block=0x44538d0)
[0220.560] CloseHandle (hObject=0x128) returned 1
[0220.560] lstrlenW (lpString="") returned 0
[0220.561] malloc (_Size=0xc) returned 0x4453830
[0220.561] SysStringLen (param_1="") returned 0x0
[0220.561] free (_Block=0x4453830)
[0220.561] lstrlenW (lpString="") returned 0
[0220.561] ITaskFolder:RegisterTask (in: This=0x4453880, Path="Updates\\lyfhOEwABQlG", XmlText="\n\n \n 2014-10-25T14:27:44.8929027\n XC64ZB\\RDhJ0CNFevzX\n \n \n \n true\n XC64ZB\\RDhJ0CNFevzX\n \n \n false\n \n \n \n \n XC64ZB\\RDhJ0CNFevzX\n InteractiveToken\n LeastPrivilege\n \n \n \n StopExisting\n false\n true\n false\n true\n false\n \n true\n false\n \n true\n true\n false\n false\n false\n PT0S\n 7\n \n \n \n C:\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\lyfhOEwABQlG.exe\n \n \n", flags=2, UserId=0x414cd60*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="", varVal2=0x0), password=0x414cd70*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), LogonType=0, sddl=0x414cd84*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), ppTask=0x414cde0 | out: ppTask=0x414cde0*=0x4453908) returned 0x0
[0222.503] GetProcessHeap () returned 0x45c0000
[0222.503] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x14) returned 0x45d20b0
[0222.503] _memicmp (_Buf1=0x45c73f0, _Buf2=0x92708, _Size=0x7) returned 0
[0222.503] LoadStringW (in: hInstance=0x0, uID=0x12e, lpBuffer=0x45ca798, cchBufferMax=256 | out: lpBuffer="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 0x40
[0222.504] lstrlenW (lpString="SUCCESS: The scheduled task \"%s\" has successfully been created.\n") returned 64
[0222.504] GetProcessHeap () returned 0x45c0000
[0222.504] RtlAllocateHeap (HeapHandle=0x45c0000, Flags=0xc, Size=0x82) returned 0x45d98b0
[0222.504] _vsnwprintf (in: _Buffer=0x414cdf8, _BufferCount=0x1fb, _Format="SUCCESS: The scheduled task \"%s\" has successfully been created.\n", _ArgList=0x414cd94 | out: _Buffer="SUCCESS: The scheduled task \"Updates\\lyfhOEwABQlG\" has successfully been created.\n") returned 82
[0222.504] __iob_func () returned 0x76621208
[0222.504] _fileno (_File=0x76621228) returned 1
[0222.504] _errno () returned 0x44505b0
[0222.504] _get_osfhandle (_FileHandle=1) returned 0x3c
[0222.504] _errno () returned 0x44505b0
[0222.504] GetFileType (hFile=0x3c) returned 0x2
[0222.505] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0222.505] GetFileType (hFile=0x3c) returned 0x2
[0222.505] GetConsoleMode (in: hConsoleHandle=0x3c, lpMode=0x414cd68 | out: lpMode=0x414cd68) returned 1
[0222.616] __iob_func () returned 0x76621208
[0222.616] GetStdHandle (nStdHandle=0xfffffff5) returned 0x3c
[0222.616] lstrlenW (lpString="SUCCESS: The scheduled task \"Updates\\lyfhOEwABQlG\" has successfully been created.\n") returned 82
[0222.616] WriteConsoleW (in: hConsoleOutput=0x3c, lpBuffer=0x414cdf8*, nNumberOfCharsToWrite=0x52, lpNumberOfCharsWritten=0x414cd8c, lpReserved=0x0 | out: lpBuffer=0x414cdf8*, lpNumberOfCharsWritten=0x414cd8c*=0x52) returned 1
[0222.714] IUnknown:Release (This=0x4453908) returned 0x0
[0222.714] TaskScheduler:IUnknown:Release (This=0x4453880) returned 0x0
[0222.714] TaskScheduler:IUnknown:Release (This=0x4453758) returned 0x0
[0222.714] lstrlenW (lpString="") returned 0
[0222.714] lstrlenW (lpString="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp") returned 52
[0222.714] WideCharToMultiByte (in: CodePage=0x1, dwFlags=0x0, lpWideCharStr="C:\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Temp\\tmp5E17.tmp", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 53
[0222.714] GetProcessHeap () returned 0x45c0000
[0222.714] GetProcessHeap () returned 0x45c0000
[0222.714] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9db8) returned 1
[0222.714] GetProcessHeap () returned 0x45c0000
[0222.714] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9db8) returned 0x1fc
[0222.715] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9db8) returned 1
[0222.716] GetProcessHeap () returned 0x45c0000
[0222.716] GetProcessHeap () returned 0x45c0000
[0222.716] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45cae20) returned 1
[0222.716] GetProcessHeap () returned 0x45c0000
[0222.716] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45cae20) returned 0x6a
[0222.716] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45cae20) returned 1
[0222.716] GetProcessHeap () returned 0x45c0000
[0222.716] GetProcessHeap () returned 0x45c0000
[0222.716] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9508) returned 1
[0222.716] GetProcessHeap () returned 0x45c0000
[0222.717] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9508) returned 0x16
[0222.717] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9508) returned 1
[0222.717] GetProcessHeap () returned 0x45c0000
[0222.717] GetProcessHeap () returned 0x45c0000
[0222.717] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45ca9d0) returned 1
[0222.717] GetProcessHeap () returned 0x45c0000
[0222.717] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45ca9d0) returned 0x10
[0222.717] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45ca9d0) returned 1
[0222.717] GetProcessHeap () returned 0x45c0000
[0222.717] GetProcessHeap () returned 0x45c0000
[0222.717] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9388) returned 1
[0222.717] GetProcessHeap () returned 0x45c0000
[0222.717] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9388) returned 0x14
[0222.717] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9388) returned 1
[0222.717] GetProcessHeap () returned 0x45c0000
[0222.717] GetProcessHeap () returned 0x45c0000
[0222.717] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c69e0) returned 1
[0222.717] GetProcessHeap () returned 0x45c0000
[0222.717] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c69e0) returned 0xa0
[0222.718] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c69e0) returned 1
[0222.718] GetProcessHeap () returned 0x45c0000
[0222.718] GetProcessHeap () returned 0x45c0000
[0222.718] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c7498) returned 1
[0222.718] GetProcessHeap () returned 0x45c0000
[0222.718] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c7498) returned 0x10
[0222.718] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c7498) returned 1
[0222.718] GetProcessHeap () returned 0x45c0000
[0222.718] GetProcessHeap () returned 0x45c0000
[0222.718] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9468) returned 1
[0222.718] GetProcessHeap () returned 0x45c0000
[0222.718] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9468) returned 0x14
[0222.718] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9468) returned 1
[0222.718] GetProcessHeap () returned 0x45c0000
[0222.718] GetProcessHeap () returned 0x45c0000
[0222.718] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45cada8) returned 1
[0222.718] GetProcessHeap () returned 0x45c0000
[0222.718] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45cada8) returned 0x6e
[0222.719] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45cada8) returned 1
[0222.719] GetProcessHeap () returned 0x45c0000
[0222.719] GetProcessHeap () returned 0x45c0000
[0222.719] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45cac10) returned 1
[0222.719] GetProcessHeap () returned 0x45c0000
[0222.719] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45cac10) returned 0x10
[0222.719] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45cac10) returned 1
[0222.719] GetProcessHeap () returned 0x45c0000
[0222.719] GetProcessHeap () returned 0x45c0000
[0222.719] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c93a8) returned 1
[0222.719] GetProcessHeap () returned 0x45c0000
[0222.719] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c93a8) returned 0x14
[0222.719] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c93a8) returned 1
[0222.719] GetProcessHeap () returned 0x45c0000
[0222.719] GetProcessHeap () returned 0x45c0000
[0222.719] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c7390) returned 1
[0222.719] GetProcessHeap () returned 0x45c0000
[0222.719] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c7390) returned 0xc
[0222.720] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c7390) returned 1
[0222.720] GetProcessHeap () returned 0x45c0000
[0222.720] GetProcessHeap () returned 0x45c0000
[0222.720] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c7378) returned 1
[0222.720] GetProcessHeap () returned 0x45c0000
[0222.720] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c7378) returned 0x10
[0222.720] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c7378) returned 1
[0222.720] GetProcessHeap () returned 0x45c0000
[0222.720] GetProcessHeap () returned 0x45c0000
[0222.720] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9588) returned 1
[0222.720] GetProcessHeap () returned 0x45c0000
[0222.720] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9588) returned 0x14
[0222.720] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9588) returned 1
[0222.720] GetProcessHeap () returned 0x45c0000
[0222.720] GetProcessHeap () returned 0x45c0000
[0222.720] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c8ce0) returned 1
[0222.720] GetProcessHeap () returned 0x45c0000
[0222.720] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c8ce0) returned 0x208
[0222.721] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c8ce0) returned 1
[0222.721] GetProcessHeap () returned 0x45c0000
[0222.721] GetProcessHeap () returned 0x45c0000
[0222.721] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c74e0) returned 1
[0222.721] GetProcessHeap () returned 0x45c0000
[0222.721] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c74e0) returned 0x10
[0222.721] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c74e0) returned 1
[0222.721] GetProcessHeap () returned 0x45c0000
[0222.721] GetProcessHeap () returned 0x45c0000
[0222.721] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9428) returned 1
[0222.721] GetProcessHeap () returned 0x45c0000
[0222.721] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9428) returned 0x14
[0222.721] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9428) returned 1
[0222.721] GetProcessHeap () returned 0x45c0000
[0222.721] GetProcessHeap () returned 0x45c0000
[0222.721] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45ca798) returned 1
[0222.721] GetProcessHeap () returned 0x45c0000
[0222.721] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45ca798) returned 0x200
[0222.722] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45ca798) returned 1
[0222.722] GetProcessHeap () returned 0x45c0000
[0222.722] GetProcessHeap () returned 0x45c0000
[0222.722] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c73f0) returned 1
[0222.722] GetProcessHeap () returned 0x45c0000
[0222.722] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c73f0) returned 0x10
[0222.722] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c73f0) returned 1
[0222.722] GetProcessHeap () returned 0x45c0000
[0222.722] GetProcessHeap () returned 0x45c0000
[0222.722] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9568) returned 1
[0222.722] GetProcessHeap () returned 0x45c0000
[0222.722] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9568) returned 0x14
[0222.722] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9568) returned 1
[0222.722] GetProcessHeap () returned 0x45c0000
[0222.722] GetProcessHeap () returned 0x45c0000
[0222.722] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c94a8) returned 1
[0222.722] GetProcessHeap () returned 0x45c0000
[0222.722] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c94a8) returned 0x14
[0222.723] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c94a8) returned 1
[0222.723] GetProcessHeap () returned 0x45c0000
[0222.723] GetProcessHeap () returned 0x45c0000
[0222.723] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c7408) returned 1
[0222.723] GetProcessHeap () returned 0x45c0000
[0222.723] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c7408) returned 0x10
[0222.723] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c7408) returned 1
[0222.723] GetProcessHeap () returned 0x45c0000
[0222.723] GetProcessHeap () returned 0x45c0000
[0222.723] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c2780) returned 1
[0222.723] GetProcessHeap () returned 0x45c0000
[0222.723] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c2780) returned 0x14
[0222.723] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c2780) returned 1
[0222.723] GetProcessHeap () returned 0x45c0000
[0222.723] GetProcessHeap () returned 0x45c0000
[0222.723] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9528) returned 1
[0222.723] GetProcessHeap () returned 0x45c0000
[0222.723] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9528) returned 0x16
[0222.723] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9528) returned 1
[0222.723] GetProcessHeap () returned 0x45c0000
[0222.723] GetProcessHeap () returned 0x45c0000
[0222.723] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c73a8) returned 1
[0222.723] GetProcessHeap () returned 0x45c0000
[0222.723] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c73a8) returned 0x10
[0222.723] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c73a8) returned 1
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c6618) returned 1
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c6618) returned 0x14
[0222.724] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c6618) returned 1
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c0598) returned 1
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c0598) returned 0x2
[0222.724] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c0598) returned 1
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c6e48) returned 1
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c6e48) returned 0x14
[0222.724] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c6e48) returned 1
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c6c10) returned 1
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c6c10) returned 0x14
[0222.724] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c6c10) returned 1
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c6c30) returned 1
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c6c30) returned 0x14
[0222.724] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c6c30) returned 1
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c6c50) returned 1
[0222.724] GetProcessHeap () returned 0x45c0000
[0222.724] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c6c50) returned 0x14
[0222.725] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c6c50) returned 1
[0222.725] GetProcessHeap () returned 0x45c0000
[0222.725] GetProcessHeap () returned 0x45c0000
[0222.725] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9488) returned 1
[0222.725] GetProcessHeap () returned 0x45c0000
[0222.725] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9488) returned 0x14
[0222.725] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9488) returned 1
[0222.725] GetProcessHeap () returned 0x45c0000
[0222.725] GetProcessHeap () returned 0x45c0000
[0222.725] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c94c8) returned 1
[0222.725] GetProcessHeap () returned 0x45c0000
[0222.725] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c94c8) returned 0x14
[0222.725] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c94c8) returned 1
[0222.725] GetProcessHeap () returned 0x45c0000
[0222.725] GetProcessHeap () returned 0x45c0000
[0222.725] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c6a88) returned 1
[0222.725] GetProcessHeap () returned 0x45c0000
[0222.725] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c6a88) returned 0x30
[0222.725] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c6a88) returned 1
[0222.725] GetProcessHeap () returned 0x45c0000
[0222.725] GetProcessHeap () returned 0x45c0000
[0222.725] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c93e8) returned 1
[0222.725] GetProcessHeap () returned 0x45c0000
[0222.725] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c93e8) returned 0x14
[0222.725] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c93e8) returned 1
[0222.725] GetProcessHeap () returned 0x45c0000
[0222.725] GetProcessHeap () returned 0x45c0000
[0222.726] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c70d0) returned 1
[0222.726] GetProcessHeap () returned 0x45c0000
[0222.726] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c70d0) returned 0x30
[0222.726] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c70d0) returned 1
[0222.726] GetProcessHeap () returned 0x45c0000
[0222.726] GetProcessHeap () returned 0x45c0000
[0222.726] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9548) returned 1
[0222.726] GetProcessHeap () returned 0x45c0000
[0222.726] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9548) returned 0x14
[0222.726] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9548) returned 1
[0222.726] GetProcessHeap () returned 0x45c0000
[0222.726] GetProcessHeap () returned 0x45c0000
[0222.726] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45d98b0) returned 1
[0222.726] GetProcessHeap () returned 0x45c0000
[0222.726] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45d98b0) returned 0x82
[0222.727] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45d98b0) returned 1
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45d20b0) returned 1
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45d20b0) returned 0x14
[0222.727] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45d20b0) returned 1
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c7468) returned 1
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c7468) returned 0x10
[0222.727] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c7468) returned 1
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c6840) returned 1
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c6840) returned 0x14
[0222.727] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c6840) returned 1
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c6860) returned 1
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c6860) returned 0x14
[0222.727] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c6860) returned 1
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c6880) returned 1
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c6880) returned 0x14
[0222.727] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c6880) returned 1
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.727] GetProcessHeap () returned 0x45c0000
[0222.728] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c65d8) returned 1
[0222.728] GetProcessHeap () returned 0x45c0000
[0222.728] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c65d8) returned 0x14
[0222.728] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c65d8) returned 1
[0222.728] GetProcessHeap () returned 0x45c0000
[0222.728] GetProcessHeap () returned 0x45c0000
[0222.728] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c7480) returned 1
[0222.728] GetProcessHeap () returned 0x45c0000
[0222.728] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c7480) returned 0x10
[0222.728] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c7480) returned 1
[0222.728] GetProcessHeap () returned 0x45c0000
[0222.728] GetProcessHeap () returned 0x45c0000
[0222.728] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c65f8) returned 1
[0222.728] GetProcessHeap () returned 0x45c0000
[0222.728] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c65f8) returned 0x14
[0222.728] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c65f8) returned 1
[0222.728] GetProcessHeap () returned 0x45c0000
[0222.728] GetProcessHeap () returned 0x45c0000
[0222.728] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c27a0) returned 1
[0222.728] GetProcessHeap () returned 0x45c0000
[0222.728] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c27a0) returned 0x14
[0222.728] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c27a0) returned 1
[0222.728] GetProcessHeap () returned 0x45c0000
[0222.728] GetProcessHeap () returned 0x45c0000
[0222.728] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c94e8) returned 1
[0222.728] GetProcessHeap () returned 0x45c0000
[0222.728] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c94e8) returned 0x14
[0222.729] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c94e8) returned 1
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9348) returned 1
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9348) returned 0x14
[0222.729] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9348) returned 1
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9368) returned 1
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9368) returned 0x14
[0222.729] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9368) returned 1
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c9628) returned 1
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c9628) returned 0x14
[0222.729] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c9628) returned 1
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c73d8) returned 1
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c73d8) returned 0x10
[0222.729] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c73d8) returned 1
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c27c0) returned 1
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c27c0) returned 0x14
[0222.729] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c27c0) returned 1
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.729] HeapValidate (hHeap=0x45c0000, dwFlags=0x0, lpMem=0x45c7450) returned 1
[0222.729] GetProcessHeap () returned 0x45c0000
[0222.730] RtlSizeHeap (HeapHandle=0x45c0000, Flags=0x0, MemoryPointer=0x45c7450) returned 0x10
[0222.730] RtlFreeHeap (HeapHandle=0x45c0000, Flags=0x0, BaseAddress=0x45c7450) returned 1
[0222.730] exit (_Code=0)
Thread:
id = 25
os_tid = 0x106c
Process:
id = "5"
image_name = "conhost.exe"
filename = "c:\\windows\\system32\\conhost.exe"
page_root = "0x484ba000"
os_pid = "0xde4"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "4"
os_parent_pid = "0xe28"
cmd_line = "\\??\\C:\\Windows\\system32\\conhost.exe 0xffffffff -ForceV1"
cur_dir = "C:\\Windows"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f600" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 778
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 779
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 780
start_va = 0x50000
end_va = 0x8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 781
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 782
start_va = 0x400000
end_va = 0x5fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 783
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 784
start_va = 0x7df5fffc0000
end_va = 0x7df5fffe2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5fffc0000"
filename = ""
Region:
id = 785
start_va = 0x7df5ffff0000
end_va = 0x7ff5fffeffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffff0000"
filename = ""
Region:
id = 786
start_va = 0x7ff78ce40000
end_va = 0x7ff78ce50fff
monitored = 0
entry_point = 0x7ff78ce416b0
region_type = mapped_file
name = "conhost.exe"
filename = "\\Windows\\System32\\conhost.exe" (normalized: "c:\\windows\\system32\\conhost.exe")
Region:
id = 787
start_va = 0x7ff884cc0000
end_va = 0x7ff884e80fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 788
start_va = 0xc0000
end_va = 0x1bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000c0000"
filename = ""
Region:
id = 789
start_va = 0x7ff881ed0000
end_va = 0x7ff8820b7fff
monitored = 0
entry_point = 0x7ff881efba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 790
start_va = 0x7ff884c10000
end_va = 0x7ff884cbcfff
monitored = 0
entry_point = 0x7ff884c281a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 791
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 792
start_va = 0x7df5ffec0000
end_va = 0x7df5fffbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffec0000"
filename = ""
Region:
id = 793
start_va = 0x600000
end_va = 0x6bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 794
start_va = 0x7ff882220000
end_va = 0x7ff8822bcfff
monitored = 0
entry_point = 0x7ff8822278a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 795
start_va = 0x1c0000
end_va = 0x1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 796
start_va = 0x6c0000
end_va = 0x77ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006c0000"
filename = ""
Region:
id = 797
start_va = 0x20000
end_va = 0x26fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 798
start_va = 0x7ff876920000
end_va = 0x7ff876978fff
monitored = 0
entry_point = 0x7ff87692fbf0
region_type = mapped_file
name = "conhostv2.dll"
filename = "\\Windows\\System32\\ConhostV2.dll" (normalized: "c:\\windows\\system32\\conhostv2.dll")
Region:
id = 801
start_va = 0x90000
end_va = 0x90fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000090000"
filename = ""
Region:
id = 802
start_va = 0x7ff8822c0000
end_va = 0x7ff88253cfff
monitored = 0
entry_point = 0x7ff882394970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 803
start_va = 0x7ff883bf0000
end_va = 0x7ff883d0bfff
monitored = 0
entry_point = 0x7ff883c302b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 804
start_va = 0x7ff881d50000
end_va = 0x7ff881db9fff
monitored = 0
entry_point = 0x7ff881d86d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 805
start_va = 0x7ff8820c0000
end_va = 0x7ff882215fff
monitored = 0
entry_point = 0x7ff8820ca8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 806
start_va = 0x7ff884a10000
end_va = 0x7ff884b95fff
monitored = 0
entry_point = 0x7ff884a5ffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 807
start_va = 0xa0000
end_va = 0xa6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000a0000"
filename = ""
Region:
id = 808
start_va = 0x7ff8842c0000
end_va = 0x7ff884402fff
monitored = 0
entry_point = 0x7ff8842e8210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 809
start_va = 0x7ff882550000
end_va = 0x7ff8825aafff
monitored = 0
entry_point = 0x7ff8825638b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 810
start_va = 0x7ff8849d0000
end_va = 0x7ff884a0afff
monitored = 0
entry_point = 0x7ff8849d12f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 811
start_va = 0x7ff884410000
end_va = 0x7ff8844d0fff
monitored = 0
entry_point = 0x7ff884430da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 812
start_va = 0x7ff87f8e0000
end_va = 0x7ff87fa65fff
monitored = 0
entry_point = 0x7ff87f92d700
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")
Region:
id = 815
start_va = 0xb0000
end_va = 0xb0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000b0000"
filename = ""
Region:
id = 816
start_va = 0x6c0000
end_va = 0x6c0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006c0000"
filename = ""
Region:
id = 817
start_va = 0x770000
end_va = 0x77ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000770000"
filename = ""
Region:
id = 818
start_va = 0x780000
end_va = 0x907fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000780000"
filename = ""
Region:
id = 819
start_va = 0x910000
end_va = 0xa90fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000910000"
filename = ""
Region:
id = 820
start_va = 0xaa0000
end_va = 0x1e9ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000aa0000"
filename = ""
Region:
id = 821
start_va = 0x6d0000
end_va = 0x6effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006d0000"
filename = ""
Region:
id = 825
start_va = 0x6f0000
end_va = 0x72ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006f0000"
filename = ""
Region:
id = 826
start_va = 0x7ff8825b0000
end_va = 0x7ff883b0efff
monitored = 0
entry_point = 0x7ff8827111f0
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 827
start_va = 0x7ff881370000
end_va = 0x7ff8813b2fff
monitored = 0
entry_point = 0x7ff881384b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 828
start_va = 0x7ff881620000
end_va = 0x7ff881c63fff
monitored = 0
entry_point = 0x7ff8817e64b0
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")
Region:
id = 829
start_va = 0x7ff884920000
end_va = 0x7ff8849c6fff
monitored = 0
entry_point = 0x7ff8849358d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 830
start_va = 0x7ff884bb0000
end_va = 0x7ff884c01fff
monitored = 0
entry_point = 0x7ff884bbf530
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 831
start_va = 0x7ff881330000
end_va = 0x7ff88133efff
monitored = 0
entry_point = 0x7ff881333210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 832
start_va = 0x7ff881c70000
end_va = 0x7ff881d24fff
monitored = 0
entry_point = 0x7ff881cb22e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 833
start_va = 0x7ff8812e0000
end_va = 0x7ff88132afff
monitored = 0
entry_point = 0x7ff8812e35f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 834
start_va = 0x7ff881340000
end_va = 0x7ff881353fff
monitored = 0
entry_point = 0x7ff8813452e0
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 836
start_va = 0x7ff87fc60000
end_va = 0x7ff87fcf5fff
monitored = 0
entry_point = 0x7ff87fc85570
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 837
start_va = 0x1ea0000
end_va = 0x208ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001ea0000"
filename = ""
Region:
id = 842
start_va = 0x2090000
end_va = 0x23c6fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 843
start_va = 0x23d0000
end_va = 0x25e3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000023d0000"
filename = ""
Region:
id = 844
start_va = 0x25f0000
end_va = 0x2803fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000025f0000"
filename = ""
Region:
id = 845
start_va = 0x1ea0000
end_va = 0x1fa9fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001ea0000"
filename = ""
Region:
id = 846
start_va = 0x2080000
end_va = 0x208ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002080000"
filename = ""
Region:
id = 849
start_va = 0x2810000
end_va = 0x2a20fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002810000"
filename = ""
Region:
id = 850
start_va = 0x2a30000
end_va = 0x2b3afff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002a30000"
filename = ""
Region:
id = 857
start_va = 0x730000
end_va = 0x76ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000730000"
filename = ""
Region:
id = 858
start_va = 0x7ff883ec0000
end_va = 0x7ff884019fff
monitored = 0
entry_point = 0x7ff883f038e0
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 859
start_va = 0x50000
end_va = 0x50fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000050000"
filename = ""
Region:
id = 860
start_va = 0x1fb0000
end_va = 0x206bfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001fb0000"
filename = ""
Region:
id = 861
start_va = 0x50000
end_va = 0x53fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000050000"
filename = ""
Region:
id = 862
start_va = 0x7ff87eb60000
end_va = 0x7ff87eb81fff
monitored = 0
entry_point = 0x7ff87eb61a40
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")
Region:
id = 863
start_va = 0x7ff87fad0000
end_va = 0x7ff87fae2fff
monitored = 0
entry_point = 0x7ff87fad2760
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")
Region:
id = 864
start_va = 0x7ff8810f0000
end_va = 0x7ff881145fff
monitored = 0
entry_point = 0x7ff881100bf0
region_type = mapped_file
name = "winsta.dll"
filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")
Region:
id = 866
start_va = 0x60000
end_va = 0x66fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000060000"
filename = ""
Region:
id = 867
start_va = 0x70000
end_va = 0x70fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000070000"
filename = ""
Region:
id = 868
start_va = 0x80000
end_va = 0x80fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000080000"
filename = ""
Region:
id = 869
start_va = 0x6d0000
end_va = 0x6d1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000006d0000"
filename = ""
Region:
id = 870
start_va = 0x6e0000
end_va = 0x6effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006e0000"
filename = ""
Region:
id = 871
start_va = 0x2070000
end_va = 0x2070fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002070000"
filename = ""
Region:
id = 872
start_va = 0x2b40000
end_va = 0x2b44fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "user32.dll.mui"
filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui")
Region:
id = 873
start_va = 0x2b50000
end_va = 0x2b50fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "conhostv2.dll.mui"
filename = "\\Windows\\System32\\en-US\\ConhostV2.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\conhostv2.dll.mui")
Region:
id = 883
start_va = 0x2b60000
end_va = 0x2b61fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002b60000"
filename = ""
Region:
id = 884
start_va = 0x7ff875c70000
end_va = 0x7ff875ee3fff
monitored = 0
entry_point = 0x7ff875ce0400
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll")
Region:
id = 885
start_va = 0x2b70000
end_va = 0x2b70fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "windowsshell.manifest"
filename = "\\Windows\\WindowsShell.Manifest" (normalized: "c:\\windows\\windowsshell.manifest")
Region:
id = 886
start_va = 0x2b80000
end_va = 0x2b81fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002b80000"
filename = ""
Thread:
id = 19
os_tid = 0x1004
Thread:
id = 20
os_tid = 0x1018
Thread:
id = 21
os_tid = 0x103c
Thread:
id = 23
os_tid = 0x1058
Process:
id = "6"
image_name = "svchost.exe"
filename = "c:\\windows\\system32\\svchost.exe"
page_root = "0x75524000"
os_pid = "0x360"
os_integrity_level = "0x4000"
os_privileges = "0xe60b1e890"
monitor_reason = "created_scheduled_job"
parent_id = "4"
os_parent_pid = "0x214"
cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs"
cur_dir = "C:\\Windows\\system32\\"
os_username = "NT AUTHORITY\\SYSTEM"
bitness = "32"
os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ac2c" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]
Region:
id = 950
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 951
start_va = 0x20000
end_va = 0x21fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000020000"
filename = ""
Region:
id = 952
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 953
start_va = 0x50000
end_va = 0xcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 954
start_va = 0xd0000
end_va = 0xd3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 955
start_va = 0xe0000
end_va = 0xe0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 956
start_va = 0xf0000
end_va = 0xf1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000f0000"
filename = ""
Region:
id = 957
start_va = 0x100000
end_va = 0x1bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 958
start_va = 0x1c0000
end_va = 0x1c0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001c0000"
filename = ""
Region:
id = 959
start_va = 0x1d0000
end_va = 0x1d0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001d0000"
filename = ""
Region:
id = 960
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001e0000"
filename = ""
Region:
id = 961
start_va = 0x1f0000
end_va = 0x1f0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001f0000"
filename = ""
Region:
id = 962
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 963
start_va = 0x400000
end_va = 0x400fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 964
start_va = 0x410000
end_va = 0x410fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000410000"
filename = ""
Region:
id = 965
start_va = 0x420000
end_va = 0x421fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000420000"
filename = ""
Region:
id = 966
start_va = 0x430000
end_va = 0x431fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000430000"
filename = ""
Region:
id = 967
start_va = 0x440000
end_va = 0x441fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "dosvc.dll.mui"
filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui")
Region:
id = 968
start_va = 0x450000
end_va = 0x456fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "newdev.dll.mui"
filename = "\\Windows\\System32\\en-US\\newdev.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\newdev.dll.mui")
Region:
id = 969
start_va = 0x460000
end_va = 0x470fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1256.nls"
filename = "\\Windows\\System32\\C_1256.NLS" (normalized: "c:\\windows\\system32\\c_1256.nls")
Region:
id = 970
start_va = 0x480000
end_va = 0x480fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000480000"
filename = ""
Region:
id = 971
start_va = 0x490000
end_va = 0x496fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000490000"
filename = ""
Region:
id = 972
start_va = 0x4a0000
end_va = 0x4a0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004a0000"
filename = ""
Region:
id = 973
start_va = 0x4b0000
end_va = 0x4b0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004b0000"
filename = ""
Region:
id = 974
start_va = 0x4c0000
end_va = 0x4c0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004c0000"
filename = ""
Region:
id = 975
start_va = 0x4d0000
end_va = 0x4d0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004d0000"
filename = ""
Region:
id = 976
start_va = 0x4e0000
end_va = 0x4e1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 977
start_va = 0x4f0000
end_va = 0x4f3fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 978
start_va = 0x500000
end_va = 0x503fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 979
start_va = 0x510000
end_va = 0x516fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000510000"
filename = ""
Region:
id = 980
start_va = 0x520000
end_va = 0x5dffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000520000"
filename = ""
Region:
id = 981
start_va = 0x5e0000
end_va = 0x5e6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005e0000"
filename = ""
Region:
id = 982
start_va = 0x5f0000
end_va = 0x5f0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000005f0000"
filename = ""
Region:
id = 983
start_va = 0x600000
end_va = 0x6fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000600000"
filename = ""
Region:
id = 984
start_va = 0x700000
end_va = 0x7fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000700000"
filename = ""
Region:
id = 985
start_va = 0x800000
end_va = 0x987fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000800000"
filename = ""
Region:
id = 986
start_va = 0x990000
end_va = 0xb10fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000990000"
filename = ""
Region:
id = 987
start_va = 0xb20000
end_va = 0xf1afff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000b20000"
filename = ""
Region:
id = 988
start_va = 0xf20000
end_va = 0xf9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f20000"
filename = ""
Region:
id = 989
start_va = 0xfa0000
end_va = 0x109ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000fa0000"
filename = ""
Region:
id = 990
start_va = 0x10a0000
end_va = 0x10a3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000010a0000"
filename = ""
Region:
id = 991
start_va = 0x10b0000
end_va = 0x10bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000010b0000"
filename = ""
Region:
id = 992
start_va = 0x10c0000
end_va = 0x10c6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000010c0000"
filename = ""
Region:
id = 993
start_va = 0x10d0000
end_va = 0x10e0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1251.nls"
filename = "\\Windows\\System32\\C_1251.NLS" (normalized: "c:\\windows\\system32\\c_1251.nls")
Region:
id = 994
start_va = 0x10f0000
end_va = 0x10fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000010f0000"
filename = ""
Region:
id = 995
start_va = 0x1100000
end_va = 0x11fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001100000"
filename = ""
Region:
id = 996
start_va = 0x1200000
end_va = 0x127ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001200000"
filename = ""
Region:
id = 997
start_va = 0x1280000
end_va = 0x137ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001280000"
filename = ""
Region:
id = 998
start_va = 0x1380000
end_va = 0x1390fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1254.nls"
filename = "\\Windows\\System32\\C_1254.NLS" (normalized: "c:\\windows\\system32\\c_1254.nls")
Region:
id = 999
start_va = 0x13a0000
end_va = 0x13a6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000013a0000"
filename = ""
Region:
id = 1000
start_va = 0x13b0000
end_va = 0x13f4fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db")
Region:
id = 1001
start_va = 0x1400000
end_va = 0x14fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001400000"
filename = ""
Region:
id = 1002
start_va = 0x1500000
end_va = 0x15fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001500000"
filename = ""
Region:
id = 1003
start_va = 0x1600000
end_va = 0x16fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001600000"
filename = ""
Region:
id = 1004
start_va = 0x1700000
end_va = 0x1a36fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1005
start_va = 0x1a40000
end_va = 0x1b3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001a40000"
filename = ""
Region:
id = 1006
start_va = 0x1b40000
end_va = 0x1c3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001b40000"
filename = ""
Region:
id = 1007
start_va = 0x1c40000
end_va = 0x1c82fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001c40000"
filename = ""
Region:
id = 1008
start_va = 0x1c90000
end_va = 0x1c96fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001c90000"
filename = ""
Region:
id = 1009
start_va = 0x1ca0000
end_va = 0x1ca0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001ca0000"
filename = ""
Region:
id = 1010
start_va = 0x1cb0000
end_va = 0x1cb0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001cb0000"
filename = ""
Region:
id = 1011
start_va = 0x1cc0000
end_va = 0x1d3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001cc0000"
filename = ""
Region:
id = 1012
start_va = 0x1d40000
end_va = 0x1e3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001d40000"
filename = ""
Region:
id = 1013
start_va = 0x1e40000
end_va = 0x1f3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001e40000"
filename = ""
Region:
id = 1014
start_va = 0x1f40000
end_va = 0x1fbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001f40000"
filename = ""
Region:
id = 1015
start_va = 0x1fc0000
end_va = 0x1fd0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1250.nls"
filename = "\\Windows\\System32\\C_1250.NLS" (normalized: "c:\\windows\\system32\\c_1250.nls")
Region:
id = 1016
start_va = 0x1fe0000
end_va = 0x1ff0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1253.nls"
filename = "\\Windows\\System32\\C_1253.NLS" (normalized: "c:\\windows\\system32\\c_1253.nls")
Region:
id = 1017
start_va = 0x2000000
end_va = 0x20fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002000000"
filename = ""
Region:
id = 1018
start_va = 0x2100000
end_va = 0x21fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002100000"
filename = ""
Region:
id = 1019
start_va = 0x2200000
end_va = 0x22fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002200000"
filename = ""
Region:
id = 1020
start_va = 0x2300000
end_va = 0x23fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002300000"
filename = ""
Region:
id = 1021
start_va = 0x2400000
end_va = 0x24fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002400000"
filename = ""
Region:
id = 1022
start_va = 0x2500000
end_va = 0x25dffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")
Region:
id = 1023
start_va = 0x25e0000
end_va = 0x25f0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1257.nls"
filename = "\\Windows\\System32\\C_1257.NLS" (normalized: "c:\\windows\\system32\\c_1257.nls")
Region:
id = 1024
start_va = 0x2600000
end_va = 0x26fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002600000"
filename = ""
Region:
id = 1025
start_va = 0x2700000
end_va = 0x27fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002700000"
filename = ""
Region:
id = 1026
start_va = 0x2800000
end_va = 0x28fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002800000"
filename = ""
Region:
id = 1027
start_va = 0x2900000
end_va = 0x29fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002900000"
filename = ""
Region:
id = 1028
start_va = 0x2a00000
end_va = 0x2afffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002a00000"
filename = ""
Region:
id = 1029
start_va = 0x2b00000
end_va = 0x2bfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002b00000"
filename = ""
Region:
id = 1030
start_va = 0x2c00000
end_va = 0x2cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002c00000"
filename = ""
Region:
id = 1031
start_va = 0x2d00000
end_va = 0x2d7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002d00000"
filename = ""
Region:
id = 1032
start_va = 0x2d80000
end_va = 0x2dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002d80000"
filename = ""
Region:
id = 1033
start_va = 0x2e00000
end_va = 0x2efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002e00000"
filename = ""
Region:
id = 1034
start_va = 0x2f00000
end_va = 0x2f7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002f00000"
filename = ""
Region:
id = 1035
start_va = 0x2f80000
end_va = 0x300dfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")
Region:
id = 1036
start_va = 0x3010000
end_va = 0x308ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003010000"
filename = ""
Region:
id = 1037
start_va = 0x3090000
end_va = 0x310ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003090000"
filename = ""
Region:
id = 1038
start_va = 0x3110000
end_va = 0x311ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003110000"
filename = ""
Region:
id = 1039
start_va = 0x3120000
end_va = 0x312ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003120000"
filename = ""
Region:
id = 1040
start_va = 0x3130000
end_va = 0x313ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003130000"
filename = ""
Region:
id = 1041
start_va = 0x3140000
end_va = 0x314ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003140000"
filename = ""
Region:
id = 1042
start_va = 0x3150000
end_va = 0x315ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003150000"
filename = ""
Region:
id = 1043
start_va = 0x3160000
end_va = 0x316ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003160000"
filename = ""
Region:
id = 1044
start_va = 0x3170000
end_va = 0x3176fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003170000"
filename = ""
Region:
id = 1045
start_va = 0x3180000
end_va = 0x31fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003180000"
filename = ""
Region:
id = 1046
start_va = 0x3200000
end_va = 0x32fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003200000"
filename = ""
Region:
id = 1047
start_va = 0x3300000
end_va = 0x33fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003300000"
filename = ""
Region:
id = 1048
start_va = 0x3400000
end_va = 0x34fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003400000"
filename = ""
Region:
id = 1049
start_va = 0x3500000
end_va = 0x35fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003500000"
filename = ""
Region:
id = 1050
start_va = 0x3600000
end_va = 0x36fffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003600000"
filename = ""
Region:
id = 1051
start_va = 0x3700000
end_va = 0x3710fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1255.nls"
filename = "\\Windows\\System32\\C_1255.NLS" (normalized: "c:\\windows\\system32\\c_1255.nls")
Region:
id = 1052
start_va = 0x3720000
end_va = 0x3723fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003720000"
filename = ""
Region:
id = 1053
start_va = 0x3730000
end_va = 0x3736fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003730000"
filename = ""
Region:
id = 1054
start_va = 0x3740000
end_va = 0x3767fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_932.nls"
filename = "\\Windows\\System32\\C_932.NLS" (normalized: "c:\\windows\\system32\\c_932.nls")
Region:
id = 1055
start_va = 0x3770000
end_va = 0x37a0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_949.nls"
filename = "\\Windows\\System32\\C_949.NLS" (normalized: "c:\\windows\\system32\\c_949.nls")
Region:
id = 1056
start_va = 0x37b0000
end_va = 0x37b1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000037b0000"
filename = ""
Region:
id = 1057
start_va = 0x37c0000
end_va = 0x37c0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000037c0000"
filename = ""
Region:
id = 1058
start_va = 0x37d0000
end_va = 0x37e0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_874.nls"
filename = "\\Windows\\System32\\C_874.NLS" (normalized: "c:\\windows\\system32\\c_874.nls")
Region:
id = 1059
start_va = 0x37f0000
end_va = 0x38effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000037f0000"
filename = ""
Region:
id = 1060
start_va = 0x38f0000
end_va = 0x38fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000038f0000"
filename = ""
Region:
id = 1061
start_va = 0x3900000
end_va = 0x39fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003900000"
filename = ""
Region:
id = 1062
start_va = 0x3a00000
end_va = 0x3a10fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_1258.nls"
filename = "\\Windows\\System32\\C_1258.NLS" (normalized: "c:\\windows\\system32\\c_1258.nls")
Region:
id = 1063
start_va = 0x3a20000
end_va = 0x3a3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003a20000"
filename = ""
Region:
id = 1064
start_va = 0x3a40000
end_va = 0x3a46fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003a40000"
filename = ""
Region:
id = 1065
start_va = 0x3a50000
end_va = 0x3b4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003a50000"
filename = ""
Region:
id = 1066
start_va = 0x3b50000
end_va = 0x3b80fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_936.nls"
filename = "\\Windows\\System32\\C_936.NLS" (normalized: "c:\\windows\\system32\\c_936.nls")
Region:
id = 1067
start_va = 0x3b90000
end_va = 0x3bc0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "c_950.nls"
filename = "\\Windows\\System32\\C_950.NLS" (normalized: "c:\\windows\\system32\\c_950.nls")
Region:
id = 1068
start_va = 0x3bd0000
end_va = 0x3bd3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003bd0000"
filename = ""
Region:
id = 1069
start_va = 0x3be0000
end_va = 0x3be1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003be0000"
filename = ""
Region:
id = 1070
start_va = 0x3bf0000
end_va = 0x3bfffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1071
start_va = 0x3c00000
end_va = 0x3cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003c00000"
filename = ""
Region:
id = 1072
start_va = 0x3d00000
end_va = 0x3dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003d00000"
filename = ""
Region:
id = 1073
start_va = 0x3e00000
end_va = 0x3efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003e00000"
filename = ""
Region:
id = 1074
start_va = 0x3f00000
end_va = 0x3f7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003f00000"
filename = ""
Region:
id = 1075
start_va = 0x3f80000
end_va = 0x3fcdfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003f80000"
filename = ""
Region:
id = 1076
start_va = 0x3fd0000
end_va = 0x3fd6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003fd0000"
filename = ""
Region:
id = 1077
start_va = 0x3fe0000
end_va = 0x3feffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003fe0000"
filename = ""
Region:
id = 1078
start_va = 0x3ff0000
end_va = 0x3ffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ff0000"
filename = ""
Region:
id = 1079
start_va = 0x4000000
end_va = 0x40fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004000000"
filename = ""
Region:
id = 1080
start_va = 0x4100000
end_va = 0x417ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004100000"
filename = ""
Region:
id = 1081
start_va = 0x4180000
end_va = 0x41fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004180000"
filename = ""
Region:
id = 1082
start_va = 0x4200000
end_va = 0x42fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004200000"
filename = ""
Region:
id = 1083
start_va = 0x4300000
end_va = 0x43fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004300000"
filename = ""
Region:
id = 1084
start_va = 0x4400000
end_va = 0x444dfff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004400000"
filename = ""
Region:
id = 1085
start_va = 0x4450000
end_va = 0x445ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004450000"
filename = ""
Region:
id = 1086
start_va = 0x4460000
end_va = 0x446ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004460000"
filename = ""
Region:
id = 1087
start_va = 0x4470000
end_va = 0x447ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004470000"
filename = ""
Region:
id = 1088
start_va = 0x4480000
end_va = 0x448ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004480000"
filename = ""
Region:
id = 1089
start_va = 0x4490000
end_va = 0x449ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004490000"
filename = ""
Region:
id = 1090
start_va = 0x44a0000
end_va = 0x44affff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000044a0000"
filename = ""
Region:
id = 1091
start_va = 0x44b0000
end_va = 0x44bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000044b0000"
filename = ""
Region:
id = 1092
start_va = 0x44c0000
end_va = 0x44cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000044c0000"
filename = ""
Region:
id = 1093
start_va = 0x44d0000
end_va = 0x44dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000044d0000"
filename = ""
Region:
id = 1094
start_va = 0x44e0000
end_va = 0x44effff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1095
start_va = 0x44f0000
end_va = 0x44fffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1096
start_va = 0x4500000
end_va = 0x45fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004500000"
filename = ""
Region:
id = 1097
start_va = 0x4600000
end_va = 0x46fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004600000"
filename = ""
Region:
id = 1098
start_va = 0x4700000
end_va = 0x47fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004700000"
filename = ""
Region:
id = 1099
start_va = 0x4800000
end_va = 0x48fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004800000"
filename = ""
Region:
id = 1100
start_va = 0x4900000
end_va = 0x49fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004900000"
filename = ""
Region:
id = 1101
start_va = 0x4a00000
end_va = 0x4afffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004a00000"
filename = ""
Region:
id = 1102
start_va = 0x4b00000
end_va = 0x4b7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b00000"
filename = ""
Region:
id = 1103
start_va = 0x4c00000
end_va = 0x4c0ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1104
start_va = 0x4c10000
end_va = 0x4c1ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1105
start_va = 0x4c20000
end_va = 0x4c2ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1106
start_va = 0x4c30000
end_va = 0x4c3ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1107
start_va = 0x4c40000
end_va = 0x4c4ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1108
start_va = 0x4c50000
end_va = 0x4c5ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1109
start_va = 0x4c60000
end_va = 0x4c6ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1110
start_va = 0x4c70000
end_va = 0x4c7ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1111
start_va = 0x4c80000
end_va = 0x4c8ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1112
start_va = 0x4c90000
end_va = 0x4c9ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1113
start_va = 0x4ca0000
end_va = 0x4caffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1114
start_va = 0x4cb0000
end_va = 0x4cbffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1115
start_va = 0x4cc0000
end_va = 0x4ccffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1116
start_va = 0x4cd0000
end_va = 0x4cdffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1117
start_va = 0x4ce0000
end_va = 0x4ceffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1118
start_va = 0x4cf0000
end_va = 0x4cfffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1119
start_va = 0x4d00000
end_va = 0x4dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004d00000"
filename = ""
Region:
id = 1120
start_va = 0x4e00000
end_va = 0x4e03fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004e00000"
filename = ""
Region:
id = 1121
start_va = 0x4e10000
end_va = 0x4e11fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004e10000"
filename = ""
Region:
id = 1122
start_va = 0x4e20000
end_va = 0x4e26fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004e20000"
filename = ""
Region:
id = 1123
start_va = 0x4e30000
end_va = 0x4e31fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "activeds.dll.mui"
filename = "\\Windows\\System32\\en-US\\activeds.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\activeds.dll.mui")
Region:
id = 1124
start_va = 0x4e40000
end_va = 0x4e4ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1125
start_va = 0x4e50000
end_va = 0x4e54fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "winnlsres.dll"
filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll")
Region:
id = 1126
start_va = 0x4e60000
end_va = 0x4f5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004e60000"
filename = ""
Region:
id = 1127
start_va = 0x4f60000
end_va = 0x4f6ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1128
start_va = 0x4f70000
end_va = 0x4f7ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1129
start_va = 0x4f80000
end_va = 0x4f8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004f80000"
filename = ""
Region:
id = 1130
start_va = 0x4f90000
end_va = 0x4f9ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1131
start_va = 0x4fa0000
end_va = 0x4faffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1132
start_va = 0x4fb0000
end_va = 0x4fbffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1133
start_va = 0x4fc0000
end_va = 0x4fcffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1134
start_va = 0x4fd0000
end_va = 0x4fdffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1135
start_va = 0x4fe0000
end_va = 0x4fe0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "msxml6r.dll"
filename = "\\Windows\\System32\\msxml6r.dll" (normalized: "c:\\windows\\system32\\msxml6r.dll")
Region:
id = 1136
start_va = 0x4ff0000
end_va = 0x4ff0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "usocore.dll.mui"
filename = "\\Windows\\System32\\en-US\\usocore.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\usocore.dll.mui")
Region:
id = 1137
start_va = 0x5000000
end_va = 0x5001fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000005000000"
filename = ""
Region:
id = 1138
start_va = 0x5030000
end_va = 0x5036fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005030000"
filename = ""
Region:
id = 1139
start_va = 0x5040000
end_va = 0x504ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1140
start_va = 0x5050000
end_va = 0x505ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1141
start_va = 0x5060000
end_va = 0x506ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1142
start_va = 0x5070000
end_va = 0x507ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1143
start_va = 0x5080000
end_va = 0x50cefff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000005080000"
filename = ""
Region:
id = 1144
start_va = 0x50d0000
end_va = 0x50dffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1145
start_va = 0x50e0000
end_va = 0x50effff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1146
start_va = 0x50f0000
end_va = 0x50fffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1147
start_va = 0x5100000
end_va = 0x51fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005100000"
filename = ""
Region:
id = 1148
start_va = 0x5200000
end_va = 0x52fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005200000"
filename = ""
Region:
id = 1149
start_va = 0x5300000
end_va = 0x53fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005300000"
filename = ""
Region:
id = 1150
start_va = 0x5400000
end_va = 0x54fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005400000"
filename = ""
Region:
id = 1151
start_va = 0x5500000
end_va = 0x55fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005500000"
filename = ""
Region:
id = 1152
start_va = 0x5600000
end_va = 0x56fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005600000"
filename = ""
Region:
id = 1153
start_va = 0x5700000
end_va = 0x57fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005700000"
filename = ""
Region:
id = 1154
start_va = 0x5800000
end_va = 0x580ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1155
start_va = 0x5810000
end_va = 0x581ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1156
start_va = 0x5820000
end_va = 0x582ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1157
start_va = 0x5830000
end_va = 0x583ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1158
start_va = 0x5840000
end_va = 0x584ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1159
start_va = 0x5850000
end_va = 0x585ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1160
start_va = 0x5860000
end_va = 0x586ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1161
start_va = 0x5870000
end_va = 0x587ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1162
start_va = 0x5880000
end_va = 0x588ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "winnlsres.dll.mui"
filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui")
Region:
id = 1163
start_va = 0x5890000
end_va = 0x598ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005890000"
filename = ""
Region:
id = 1164
start_va = 0x5990000
end_va = 0x599ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1165
start_va = 0x59a0000
end_va = 0x59affff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1166
start_va = 0x59b0000
end_va = 0x59bffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1167
start_va = 0x59c0000
end_va = 0x59cffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1168
start_va = 0x59d0000
end_va = 0x59dffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1169
start_va = 0x59e0000
end_va = 0x59effff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1170
start_va = 0x59f0000
end_va = 0x5aeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000059f0000"
filename = ""
Region:
id = 1171
start_va = 0x5af0000
end_va = 0x5beffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005af0000"
filename = ""
Region:
id = 1172
start_va = 0x5bf0000
end_va = 0x5ceffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005bf0000"
filename = ""
Region:
id = 1173
start_va = 0x5cf0000
end_va = 0x5deffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005cf0000"
filename = ""
Region:
id = 1174
start_va = 0x5df0000
end_va = 0x5dfffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1175
start_va = 0x5e00000
end_va = 0x5e0ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1176
start_va = 0x5e10000
end_va = 0x5e1ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1177
start_va = 0x5e20000
end_va = 0x5e2ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1178
start_va = 0x5e30000
end_va = 0x5e3ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1179
start_va = 0x5e40000
end_va = 0x5e4ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1180
start_va = 0x5e50000
end_va = 0x5e5ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1181
start_va = 0x5e60000
end_va = 0x5e6ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1182
start_va = 0x5e70000
end_va = 0x5f6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005e70000"
filename = ""
Region:
id = 1183
start_va = 0x5f70000
end_va = 0x5feffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005f70000"
filename = ""
Region:
id = 1184
start_va = 0x5ff0000
end_va = 0x606ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005ff0000"
filename = ""
Region:
id = 1185
start_va = 0x6070000
end_va = 0x616ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006070000"
filename = ""
Region:
id = 1186
start_va = 0x6170000
end_va = 0x626ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006170000"
filename = ""
Region:
id = 1187
start_va = 0x6270000
end_va = 0x627ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1188
start_va = 0x6280000
end_va = 0x628ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "datastore.edb"
filename = "\\Windows\\SoftwareDistribution\\DataStore\\DataStore.edb" (normalized: "c:\\windows\\softwaredistribution\\datastore\\datastore.edb")
Region:
id = 1189
start_va = 0x62d0000
end_va = 0x62d6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000062d0000"
filename = ""
Region:
id = 1190
start_va = 0x6300000
end_va = 0x63fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006300000"
filename = ""
Region:
id = 1191
start_va = 0x6400000
end_va = 0x64fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006400000"
filename = ""
Region:
id = 1192
start_va = 0x6500000
end_va = 0x65fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006500000"
filename = ""
Region:
id = 1193
start_va = 0x6800000
end_va = 0x68fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006800000"
filename = ""
Region:
id = 1194
start_va = 0x6900000
end_va = 0x69fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006900000"
filename = ""
Region:
id = 1195
start_va = 0x6a00000
end_va = 0x6afffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006a00000"
filename = ""
Region:
id = 1196
start_va = 0x6b00000
end_va = 0x6bfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006b00000"
filename = ""
Region:
id = 1197
start_va = 0x6c00000
end_va = 0x6cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006c00000"
filename = ""
Region:
id = 1198
start_va = 0x6d00000
end_va = 0x6dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006d00000"
filename = ""
Region:
id = 1199
start_va = 0x6e00000
end_va = 0x6efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006e00000"
filename = ""
Region:
id = 1200
start_va = 0x6f00000
end_va = 0x6ffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006f00000"
filename = ""
Region:
id = 1201
start_va = 0x7000000
end_va = 0x70fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007000000"
filename = ""
Region:
id = 1202
start_va = 0x7100000
end_va = 0x71fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007100000"
filename = ""
Region:
id = 1203
start_va = 0x7200000
end_va = 0x72fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007200000"
filename = ""
Region:
id = 1204
start_va = 0x7300000
end_va = 0x73fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007300000"
filename = ""
Region:
id = 1205
start_va = 0x7400000
end_va = 0x74fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007400000"
filename = ""
Region:
id = 1206
start_va = 0x7500000
end_va = 0x75fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007500000"
filename = ""
Region:
id = 1207
start_va = 0x7600000
end_va = 0x76fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007600000"
filename = ""
Region:
id = 1208
start_va = 0x7820000
end_va = 0x791ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007820000"
filename = ""
Region:
id = 1209
start_va = 0x7a00000
end_va = 0x7afffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007a00000"
filename = ""
Region:
id = 1210
start_va = 0x7b00000
end_va = 0x7bfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007b00000"
filename = ""
Region:
id = 1211
start_va = 0x7c00000
end_va = 0x7cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c00000"
filename = ""
Region:
id = 1212
start_va = 0x7d00000
end_va = 0x7dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007d00000"
filename = ""
Region:
id = 1213
start_va = 0x7e00000
end_va = 0x7efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007e00000"
filename = ""
Region:
id = 1214
start_va = 0x8020000
end_va = 0x811ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008020000"
filename = ""
Region:
id = 1215
start_va = 0x8300000
end_va = 0x83fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008300000"
filename = ""
Region:
id = 1216
start_va = 0x8400000
end_va = 0xa3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008400000"
filename = ""
Region:
id = 1217
start_va = 0xa400000
end_va = 0xa4fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000a400000"
filename = ""
Region:
id = 1218
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 1219
start_va = 0x7df5ffec0000
end_va = 0x7df5fffbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffec0000"
filename = ""
Region:
id = 1220
start_va = 0x7df5fffc0000
end_va = 0x7df5fffe2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5fffc0000"
filename = ""
Region:
id = 1221
start_va = 0x7df5ffff0000
end_va = 0x7ff5fffeffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffff0000"
filename = ""
Region:
id = 1222
start_va = 0x7ff6a1cd0000
end_va = 0x7ff6a1cdcfff
monitored = 0
entry_point = 0x7ff6a1cd3980
region_type = mapped_file
name = "svchost.exe"
filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")
Region:
id = 1223
start_va = 0x7ff865380000
end_va = 0x7ff86562ffff
monitored = 0
entry_point = 0x7ff865381cf0
region_type = mapped_file
name = "netshell.dll"
filename = "\\Windows\\System32\\netshell.dll" (normalized: "c:\\windows\\system32\\netshell.dll")
Region:
id = 1224
start_va = 0x7ff86b8f0000
end_va = 0x7ff86b92efff
monitored = 0
entry_point = 0x7ff86b9182d0
region_type = mapped_file
name = "tcpipcfg.dll"
filename = "\\Windows\\System32\\tcpipcfg.dll" (normalized: "c:\\windows\\system32\\tcpipcfg.dll")
Region:
id = 1225
start_va = 0x7ff86f4c0000
end_va = 0x7ff86f4f5fff
monitored = 0
entry_point = 0x7ff86f4c27f0
region_type = mapped_file
name = "windows.networking.hostname.dll"
filename = "\\Windows\\System32\\Windows.Networking.HostName.dll" (normalized: "c:\\windows\\system32\\windows.networking.hostname.dll")
Region:
id = 1226
start_va = 0x7ff8701d0000
end_va = 0x7ff8701e5fff
monitored = 0
entry_point = 0x7ff8701d1af0
region_type = mapped_file
name = "napinsp.dll"
filename = "\\Windows\\System32\\NapiNSP.dll" (normalized: "c:\\windows\\system32\\napinsp.dll")
Region:
id = 1227
start_va = 0x7ff8701f0000
end_va = 0x7ff870209fff
monitored = 0
entry_point = 0x7ff8701f2330
region_type = mapped_file
name = "pnrpnsp.dll"
filename = "\\Windows\\System32\\pnrpnsp.dll" (normalized: "c:\\windows\\system32\\pnrpnsp.dll")
Region:
id = 1228
start_va = 0x7ff870210000
end_va = 0x7ff87021cfff
monitored = 0
entry_point = 0x7ff870211420
region_type = mapped_file
name = "winrnr.dll"
filename = "\\Windows\\System32\\winrnr.dll" (normalized: "c:\\windows\\system32\\winrnr.dll")
Region:
id = 1229
start_va = 0x7ff870230000
end_va = 0x7ff8702b3fff
monitored = 0
entry_point = 0x7ff870248d50
region_type = mapped_file
name = "wbemess.dll"
filename = "\\Windows\\System32\\wbem\\wbemess.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemess.dll")
Region:
id = 1230
start_va = 0x7ff8702c0000
end_va = 0x7ff8702d5fff
monitored = 0
entry_point = 0x7ff8702c55e0
region_type = mapped_file
name = "ncobjapi.dll"
filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll")
Region:
id = 1231
start_va = 0x7ff8702e0000
end_va = 0x7ff8703b5fff
monitored = 0
entry_point = 0x7ff87030a800
region_type = mapped_file
name = "wmiprvsd.dll"
filename = "\\Windows\\System32\\wbem\\WmiPrvSD.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprvsd.dll")
Region:
id = 1232
start_va = 0x7ff8703c0000
end_va = 0x7ff870423fff
monitored = 0
entry_point = 0x7ff8703dbed0
region_type = mapped_file
name = "repdrvfs.dll"
filename = "\\Windows\\System32\\wbem\\repdrvfs.dll" (normalized: "c:\\windows\\system32\\wbem\\repdrvfs.dll")
Region:
id = 1233
start_va = 0x7ff870430000
end_va = 0x7ff870454fff
monitored = 0
entry_point = 0x7ff870439900
region_type = mapped_file
name = "wmiutils.dll"
filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll")
Region:
id = 1234
start_va = 0x7ff870460000
end_va = 0x7ff870473fff
monitored = 0
entry_point = 0x7ff870461800
region_type = mapped_file
name = "wbemsvc.dll"
filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")
Region:
id = 1235
start_va = 0x7ff870480000
end_va = 0x7ff870575fff
monitored = 0
entry_point = 0x7ff8704b9590
region_type = mapped_file
name = "fastprox.dll"
filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")
Region:
id = 1236
start_va = 0x7ff870580000
end_va = 0x7ff8705f3fff
monitored = 0
entry_point = 0x7ff870595eb0
region_type = mapped_file
name = "esscli.dll"
filename = "\\Windows\\System32\\wbem\\esscli.dll" (normalized: "c:\\windows\\system32\\wbem\\esscli.dll")
Region:
id = 1237
start_va = 0x7ff870600000
end_va = 0x7ff870736fff
monitored = 0
entry_point = 0x7ff870640480
region_type = mapped_file
name = "wbemcore.dll"
filename = "\\Windows\\System32\\wbem\\wbemcore.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemcore.dll")
Region:
id = 1238
start_va = 0x7ff870790000
end_va = 0x7ff87079efff
monitored = 0
entry_point = 0x7ff870794960
region_type = mapped_file
name = "nci.dll"
filename = "\\Windows\\System32\\nci.dll" (normalized: "c:\\windows\\system32\\nci.dll")
Region:
id = 1239
start_va = 0x7ff8707b0000
end_va = 0x7ff8707f5fff
monitored = 0
entry_point = 0x7ff8707b79a0
region_type = mapped_file
name = "adsldp.dll"
filename = "\\Windows\\System32\\adsldp.dll" (normalized: "c:\\windows\\system32\\adsldp.dll")
Region:
id = 1240
start_va = 0x7ff870800000
end_va = 0x7ff87083ffff
monitored = 0
entry_point = 0x7ff87080cbe0
region_type = mapped_file
name = "adsldpc.dll"
filename = "\\Windows\\System32\\adsldpc.dll" (normalized: "c:\\windows\\system32\\adsldpc.dll")
Region:
id = 1241
start_va = 0x7ff870840000
end_va = 0x7ff870886fff
monitored = 0
entry_point = 0x7ff870841d10
region_type = mapped_file
name = "activeds.dll"
filename = "\\Windows\\System32\\activeds.dll" (normalized: "c:\\windows\\system32\\activeds.dll")
Region:
id = 1242
start_va = 0x7ff870890000
end_va = 0x7ff8708a0fff
monitored = 0
entry_point = 0x7ff870892fc0
region_type = mapped_file
name = "wbemprox.dll"
filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")
Region:
id = 1243
start_va = 0x7ff8708b0000
end_va = 0x7ff8708cdfff
monitored = 0
entry_point = 0x7ff8708b3a40
region_type = mapped_file
name = "atl.dll"
filename = "\\Windows\\System32\\atl.dll" (normalized: "c:\\windows\\system32\\atl.dll")
Region:
id = 1244
start_va = 0x7ff8708d0000
end_va = 0x7ff870951fff
monitored = 0
entry_point = 0x7ff8708d2a10
region_type = mapped_file
name = "hnetcfg.dll"
filename = "\\Windows\\System32\\hnetcfg.dll" (normalized: "c:\\windows\\system32\\hnetcfg.dll")
Region:
id = 1245
start_va = 0x7ff870960000
end_va = 0x7ff870970fff
monitored = 0
entry_point = 0x7ff870967480
region_type = mapped_file
name = "tetheringclient.dll"
filename = "\\Windows\\System32\\tetheringclient.dll" (normalized: "c:\\windows\\system32\\tetheringclient.dll")
Region:
id = 1246
start_va = 0x7ff8709f0000
end_va = 0x7ff870a31fff
monitored = 0
entry_point = 0x7ff8709f3670
region_type = mapped_file
name = "wdscore.dll"
filename = "\\Windows\\System32\\wdscore.dll" (normalized: "c:\\windows\\system32\\wdscore.dll")
Region:
id = 1247
start_va = 0x7ff8717e0000
end_va = 0x7ff8717fefff
monitored = 0
entry_point = 0x7ff8717e37e0
region_type = mapped_file
name = "netsetupapi.dll"
filename = "\\Windows\\System32\\NetSetupApi.dll" (normalized: "c:\\windows\\system32\\netsetupapi.dll")
Region:
id = 1248
start_va = 0x7ff871800000
end_va = 0x7ff871878fff
monitored = 0
entry_point = 0x7ff8718076a0
region_type = mapped_file
name = "netsetupshim.dll"
filename = "\\Windows\\System32\\NetSetupShim.dll" (normalized: "c:\\windows\\system32\\netsetupshim.dll")
Region:
id = 1249
start_va = 0x7ff871ab0000
end_va = 0x7ff871ac3fff
monitored = 0
entry_point = 0x7ff871ab3710
region_type = mapped_file
name = "mskeyprotect.dll"
filename = "\\Windows\\System32\\mskeyprotect.dll" (normalized: "c:\\windows\\system32\\mskeyprotect.dll")
Region:
id = 1250
start_va = 0x7ff871ad0000
end_va = 0x7ff871af7fff
monitored = 0
entry_point = 0x7ff871adefc0
region_type = mapped_file
name = "dssenh.dll"
filename = "\\Windows\\System32\\dssenh.dll" (normalized: "c:\\windows\\system32\\dssenh.dll")
Region:
id = 1251
start_va = 0x7ff871b60000
end_va = 0x7ff871b7dfff
monitored = 0
entry_point = 0x7ff871b6ef80
region_type = mapped_file
name = "ncryptsslp.dll"
filename = "\\Windows\\System32\\ncryptsslp.dll" (normalized: "c:\\windows\\system32\\ncryptsslp.dll")
Region:
id = 1252
start_va = 0x7ff871b80000
end_va = 0x7ff871b97fff
monitored = 0
entry_point = 0x7ff871b84e10
region_type = mapped_file
name = "adhsvc.dll"
filename = "\\Windows\\System32\\adhsvc.dll" (normalized: "c:\\windows\\system32\\adhsvc.dll")
Region:
id = 1253
start_va = 0x7ff871ba0000
end_va = 0x7ff871bc4fff
monitored = 0
entry_point = 0x7ff871ba5ca0
region_type = mapped_file
name = "httpprxm.dll"
filename = "\\Windows\\System32\\httpprxm.dll" (normalized: "c:\\windows\\system32\\httpprxm.dll")
Region:
id = 1254
start_va = 0x7ff871c00000
end_va = 0x7ff871c40fff
monitored = 0
entry_point = 0x7ff871c03750
region_type = mapped_file
name = "sqmapi.dll"
filename = "\\Windows\\System32\\sqmapi.dll" (normalized: "c:\\windows\\system32\\sqmapi.dll")
Region:
id = 1255
start_va = 0x7ff871c50000
end_va = 0x7ff871d42fff
monitored = 0
entry_point = 0x7ff871c75d80
region_type = mapped_file
name = "iphlpsvc.dll"
filename = "\\Windows\\System32\\iphlpsvc.dll" (normalized: "c:\\windows\\system32\\iphlpsvc.dll")
Region:
id = 1256
start_va = 0x7ff871e70000
end_va = 0x7ff871f12fff
monitored = 0
entry_point = 0x7ff871e72c10
region_type = mapped_file
name = "clusapi.dll"
filename = "\\Windows\\System32\\clusapi.dll" (normalized: "c:\\windows\\system32\\clusapi.dll")
Region:
id = 1257
start_va = 0x7ff871f20000
end_va = 0x7ff871f71fff
monitored = 0
entry_point = 0x7ff871f25770
region_type = mapped_file
name = "resutils.dll"
filename = "\\Windows\\System32\\resutils.dll" (normalized: "c:\\windows\\system32\\resutils.dll")
Region:
id = 1258
start_va = 0x7ff871f80000
end_va = 0x7ff871fadfff
monitored = 1
entry_point = 0x7ff871f82300
region_type = mapped_file
name = "wmidcom.dll"
filename = "\\Windows\\System32\\wmidcom.dll" (normalized: "c:\\windows\\system32\\wmidcom.dll")
Region:
id = 1259
start_va = 0x7ff871fb0000
end_va = 0x7ff87200dfff
monitored = 0
entry_point = 0x7ff871fb5080
region_type = mapped_file
name = "miutils.dll"
filename = "\\Windows\\System32\\miutils.dll" (normalized: "c:\\windows\\system32\\miutils.dll")
Region:
id = 1260
start_va = 0x7ff872010000
end_va = 0x7ff87202ffff
monitored = 0
entry_point = 0x7ff872011f50
region_type = mapped_file
name = "mi.dll"
filename = "\\Windows\\System32\\mi.dll" (normalized: "c:\\windows\\system32\\mi.dll")
Region:
id = 1261
start_va = 0x7ff872030000
end_va = 0x7ff872038fff
monitored = 0
entry_point = 0x7ff8720318f0
region_type = mapped_file
name = "sscoreext.dll"
filename = "\\Windows\\System32\\sscoreext.dll" (normalized: "c:\\windows\\system32\\sscoreext.dll")
Region:
id = 1262
start_va = 0x7ff872040000
end_va = 0x7ff872050fff
monitored = 0
entry_point = 0x7ff872041d30
region_type = mapped_file
name = "sscore.dll"
filename = "\\Windows\\System32\\sscore.dll" (normalized: "c:\\windows\\system32\\sscore.dll")
Region:
id = 1263
start_va = 0x7ff872110000
end_va = 0x7ff872127fff
monitored = 0
entry_point = 0x7ff872112000
region_type = mapped_file
name = "vsstrace.dll"
filename = "\\Windows\\System32\\vsstrace.dll" (normalized: "c:\\windows\\system32\\vsstrace.dll")
Region:
id = 1264
start_va = 0x7ff872130000
end_va = 0x7ff8722b1fff
monitored = 0
entry_point = 0x7ff8721482a0
region_type = mapped_file
name = "vssapi.dll"
filename = "\\Windows\\System32\\vssapi.dll" (normalized: "c:\\windows\\system32\\vssapi.dll")
Region:
id = 1265
start_va = 0x7ff8722c0000
end_va = 0x7ff87230bfff
monitored = 0
entry_point = 0x7ff8722d5310
region_type = mapped_file
name = "srvsvc.dll"
filename = "\\Windows\\System32\\srvsvc.dll" (normalized: "c:\\windows\\system32\\srvsvc.dll")
Region:
id = 1266
start_va = 0x7ff872310000
end_va = 0x7ff87238efff
monitored = 0
entry_point = 0x7ff872327110
region_type = mapped_file
name = "wbemcomn.dll"
filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")
Region:
id = 1267
start_va = 0x7ff872390000
end_va = 0x7ff8723cbfff
monitored = 0
entry_point = 0x7ff872396aa0
region_type = mapped_file
name = "wmisvc.dll"
filename = "\\Windows\\System32\\wbem\\WMIsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wmisvc.dll")
Region:
id = 1268
start_va = 0x7ff872470000
end_va = 0x7ff87247bfff
monitored = 0
entry_point = 0x7ff8724735c0
region_type = mapped_file
name = "secur32.dll"
filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")
Region:
id = 1269
start_va = 0x7ff8737e0000
end_va = 0x7ff873814fff
monitored = 0
entry_point = 0x7ff8737ea270
region_type = mapped_file
name = "fwpolicyiomgr.dll"
filename = "\\Windows\\System32\\fwpolicyiomgr.dll" (normalized: "c:\\windows\\system32\\fwpolicyiomgr.dll")
Region:
id = 1270
start_va = 0x7ff873d90000
end_va = 0x7ff873da5fff
monitored = 0
entry_point = 0x7ff873d91d50
region_type = mapped_file
name = "wwapi.dll"
filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll")
Region:
id = 1271
start_va = 0x7ff874360000
end_va = 0x7ff874369fff
monitored = 0
entry_point = 0x7ff874361350
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")
Region:
id = 1272
start_va = 0x7ff876220000
end_va = 0x7ff876499fff
monitored = 0
entry_point = 0x7ff87623a7a0
region_type = mapped_file
name = "msxml6.dll"
filename = "\\Windows\\System32\\msxml6.dll" (normalized: "c:\\windows\\system32\\msxml6.dll")
Region:
id = 1273
start_va = 0x7ff8764b0000
end_va = 0x7ff876531fff
monitored = 0
entry_point = 0x7ff8764b1790
region_type = mapped_file
name = "newdev.dll"
filename = "\\Windows\\System32\\newdev.dll" (normalized: "c:\\windows\\system32\\newdev.dll")
Region:
id = 1274
start_va = 0x7ff876540000
end_va = 0x7ff876879fff
monitored = 0
entry_point = 0x7ff876548520
region_type = mapped_file
name = "msi.dll"
filename = "\\Windows\\System32\\msi.dll" (normalized: "c:\\windows\\system32\\msi.dll")
Region:
id = 1275
start_va = 0x7ff876880000
end_va = 0x7ff876903fff
monitored = 0
entry_point = 0x7ff876892830
region_type = mapped_file
name = "winspool.drv"
filename = "\\Windows\\System32\\winspool.drv" (normalized: "c:\\windows\\system32\\winspool.drv")
Region:
id = 1276
start_va = 0x7ff8769a0000
end_va = 0x7ff876c98fff
monitored = 0
entry_point = 0x7ff876a67280
region_type = mapped_file
name = "esent.dll"
filename = "\\Windows\\System32\\esent.dll" (normalized: "c:\\windows\\system32\\esent.dll")
Region:
id = 1277
start_va = 0x7ff876ca0000
end_va = 0x7ff876ed5fff
monitored = 0
entry_point = 0x7ff876d2a450
region_type = mapped_file
name = "wuaueng.dll"
filename = "\\Windows\\System32\\wuaueng.dll" (normalized: "c:\\windows\\system32\\wuaueng.dll")
Region:
id = 1278
start_va = 0x7ff876ee0000
end_va = 0x7ff876f01fff
monitored = 0
entry_point = 0x7ff876ef2540
region_type = mapped_file
name = "updatepolicy.dll"
filename = "\\Windows\\System32\\updatepolicy.dll" (normalized: "c:\\windows\\system32\\updatepolicy.dll")
Region:
id = 1279
start_va = 0x7ff876f10000
end_va = 0x7ff876fe4fff
monitored = 0
entry_point = 0x7ff876f2cf80
region_type = mapped_file
name = "wuapi.dll"
filename = "\\Windows\\System32\\wuapi.dll" (normalized: "c:\\windows\\system32\\wuapi.dll")
Region:
id = 1280
start_va = 0x7ff8777d0000
end_va = 0x7ff877834fff
monitored = 0
entry_point = 0x7ff8777e3170
region_type = mapped_file
name = "wuuhext.dll"
filename = "\\Windows\\System32\\wuuhext.dll" (normalized: "c:\\windows\\system32\\wuuhext.dll")
Region:
id = 1281
start_va = 0x7ff8779a0000
end_va = 0x7ff8779e3fff
monitored = 0
entry_point = 0x7ff8779c83e0
region_type = mapped_file
name = "updatehandlers.dll"
filename = "\\Windows\\System32\\updatehandlers.dll" (normalized: "c:\\windows\\system32\\updatehandlers.dll")
Region:
id = 1282
start_va = 0x7ff8779f0000
end_va = 0x7ff877a4cfff
monitored = 0
entry_point = 0x7ff877a1e510
region_type = mapped_file
name = "usocore.dll"
filename = "\\Windows\\System32\\usocore.dll" (normalized: "c:\\windows\\system32\\usocore.dll")
Region:
id = 1283
start_va = 0x7ff877a50000
end_va = 0x7ff877a5ffff
monitored = 0
entry_point = 0x7ff877a51700
region_type = mapped_file
name = "proximityservicepal.dll"
filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll")
Region:
id = 1284
start_va = 0x7ff877a60000
end_va = 0x7ff877a68fff
monitored = 0
entry_point = 0x7ff877a61ed0
region_type = mapped_file
name = "proximitycommonpal.dll"
filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll")
Region:
id = 1285
start_va = 0x7ff877a70000
end_va = 0x7ff877a9cfff
monitored = 0
entry_point = 0x7ff877a72290
region_type = mapped_file
name = "proximitycommon.dll"
filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll")
Region:
id = 1286
start_va = 0x7ff877aa0000
end_va = 0x7ff877af1fff
monitored = 0
entry_point = 0x7ff877aa38e0
region_type = mapped_file
name = "proximityservice.dll"
filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll")
Region:
id = 1287
start_va = 0x7ff877c20000
end_va = 0x7ff877c36fff
monitored = 0
entry_point = 0x7ff877c27520
region_type = mapped_file
name = "usoapi.dll"
filename = "\\Windows\\System32\\usoapi.dll" (normalized: "c:\\windows\\system32\\usoapi.dll")
Region:
id = 1288
start_va = 0x7ff877db0000
end_va = 0x7ff877db9fff
monitored = 0
entry_point = 0x7ff877db14c0
region_type = mapped_file
name = "rasadhlp.dll"
filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")
Region:
id = 1289
start_va = 0x7ff8784c0000
end_va = 0x7ff8784d2fff
monitored = 0
entry_point = 0x7ff8784c1b10
region_type = mapped_file
name = "devrtl.dll"
filename = "\\Windows\\System32\\devrtl.dll" (normalized: "c:\\windows\\system32\\devrtl.dll")
Region:
id = 1290
start_va = 0x7ff8784e0000
end_va = 0x7ff87857ffff
monitored = 0
entry_point = 0x7ff878550910
region_type = mapped_file
name = "wer.dll"
filename = "\\Windows\\System32\\wer.dll" (normalized: "c:\\windows\\system32\\wer.dll")
Region:
id = 1291
start_va = 0x7ff878580000
end_va = 0x7ff8785a5fff
monitored = 0
entry_point = 0x7ff878599020
region_type = mapped_file
name = "devicemetadataretrievalclient.dll"
filename = "\\Windows\\System32\\DeviceMetadataRetrievalClient.dll" (normalized: "c:\\windows\\system32\\devicemetadataretrievalclient.dll")
Region:
id = 1292
start_va = 0x7ff8786a0000
end_va = 0x7ff8786b7fff
monitored = 0
entry_point = 0x7ff8786ab850
region_type = mapped_file
name = "dmcmnutils.dll"
filename = "\\Windows\\System32\\dmcmnutils.dll" (normalized: "c:\\windows\\system32\\dmcmnutils.dll")
Region:
id = 1293
start_va = 0x7ff8786c0000
end_va = 0x7ff8786d0fff
monitored = 0
entry_point = 0x7ff8786c28d0
region_type = mapped_file
name = "credentialmigrationhandler.dll"
filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll")
Region:
id = 1294
start_va = 0x7ff878820000
end_va = 0x7ff878851fff
monitored = 0
entry_point = 0x7ff87882b0c0
region_type = mapped_file
name = "shacct.dll"
filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll")
Region:
id = 1295
start_va = 0x7ff878860000
end_va = 0x7ff878877fff
monitored = 0
entry_point = 0x7ff878861b10
region_type = mapped_file
name = "locationframeworkinternalps.dll"
filename = "\\Windows\\System32\\LocationFrameworkInternalPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkinternalps.dll")
Region:
id = 1296
start_va = 0x7ff878880000
end_va = 0x7ff878887fff
monitored = 0
entry_point = 0x7ff8788813b0
region_type = mapped_file
name = "dmiso8601utils.dll"
filename = "\\Windows\\System32\\dmiso8601utils.dll" (normalized: "c:\\windows\\system32\\dmiso8601utils.dll")
Region:
id = 1297
start_va = 0x7ff878890000
end_va = 0x7ff87899efff
monitored = 0
entry_point = 0x7ff8788cc010
region_type = mapped_file
name = "dosvc.dll"
filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll")
Region:
id = 1298
start_va = 0x7ff878b60000
end_va = 0x7ff878bc6fff
monitored = 0
entry_point = 0x7ff878b6b160
region_type = mapped_file
name = "upnp.dll"
filename = "\\Windows\\System32\\upnp.dll" (normalized: "c:\\windows\\system32\\upnp.dll")
Region:
id = 1299
start_va = 0x7ff878bd0000
end_va = 0x7ff878be3fff
monitored = 0
entry_point = 0x7ff878bd2a00
region_type = mapped_file
name = "bitsigd.dll"
filename = "\\Windows\\System32\\bitsigd.dll" (normalized: "c:\\windows\\system32\\bitsigd.dll")
Region:
id = 1300
start_va = 0x7ff878f30000
end_va = 0x7ff87904cfff
monitored = 0
entry_point = 0x7ff878f5fe60
region_type = mapped_file
name = "qmgr.dll"
filename = "\\Windows\\System32\\qmgr.dll" (normalized: "c:\\windows\\system32\\qmgr.dll")
Region:
id = 1301
start_va = 0x7ff879450000
end_va = 0x7ff87945cfff
monitored = 0
entry_point = 0x7ff879455020
region_type = mapped_file
name = "devicedriverretrievalclient.dll"
filename = "\\Windows\\System32\\DeviceDriverRetrievalClient.dll" (normalized: "c:\\windows\\system32\\devicedriverretrievalclient.dll")
Region:
id = 1302
start_va = 0x7ff879460000
end_va = 0x7ff879483fff
monitored = 0
entry_point = 0x7ff879476390
region_type = mapped_file
name = "devpropmgr.dll"
filename = "\\Windows\\System32\\DevPropMgr.dll" (normalized: "c:\\windows\\system32\\devpropmgr.dll")
Region:
id = 1303
start_va = 0x7ff879720000
end_va = 0x7ff879731fff
monitored = 0
entry_point = 0x7ff879723580
region_type = mapped_file
name = "cscapi.dll"
filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")
Region:
id = 1304
start_va = 0x7ff8797b0000
end_va = 0x7ff8797cafff
monitored = 0
entry_point = 0x7ff8797b1040
region_type = mapped_file
name = "mpr.dll"
filename = "\\Windows\\System32\\mpr.dll" (normalized: "c:\\windows\\system32\\mpr.dll")
Region:
id = 1305
start_va = 0x7ff8797d0000
end_va = 0x7ff8797ddfff
monitored = 0
entry_point = 0x7ff8797d1460
region_type = mapped_file
name = "npmproxy.dll"
filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")
Region:
id = 1306
start_va = 0x7ff8797e0000
end_va = 0x7ff87985ffff
monitored = 0
entry_point = 0x7ff87980d280
region_type = mapped_file
name = "webio.dll"
filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")
Region:
id = 1307
start_va = 0x7ff879860000
end_va = 0x7ff879874fff
monitored = 0
entry_point = 0x7ff879862dc0
region_type = mapped_file
name = "ondemandconnroutehelper.dll"
filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll")
Region:
id = 1308
start_va = 0x7ff879880000
end_va = 0x7ff879919fff
monitored = 0
entry_point = 0x7ff87989ada0
region_type = mapped_file
name = "shsvcs.dll"
filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll")
Region:
id = 1309
start_va = 0x7ff879a60000
end_va = 0x7ff879b0dfff
monitored = 0
entry_point = 0x7ff879a780c0
region_type = mapped_file
name = "windows.networking.connectivity.dll"
filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll")
Region:
id = 1310
start_va = 0x7ff879b10000
end_va = 0x7ff879b21fff
monitored = 0
entry_point = 0x7ff879b19260
region_type = mapped_file
name = "rilproxy.dll"
filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll")
Region:
id = 1311
start_va = 0x7ff879b30000
end_va = 0x7ff879be0fff
monitored = 0
entry_point = 0x7ff879ba88b0
region_type = mapped_file
name = "cellularapi.dll"
filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll")
Region:
id = 1312
start_va = 0x7ff879c90000
end_va = 0x7ff879cf6fff
monitored = 0
entry_point = 0x7ff879c963e0
region_type = mapped_file
name = "fwpuclnt.dll"
filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")
Region:
id = 1313
start_va = 0x7ff879d00000
end_va = 0x7ff879d24fff
monitored = 0
entry_point = 0x7ff879d12f20
region_type = mapped_file
name = "wificonnapi.dll"
filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll")
Region:
id = 1314
start_va = 0x7ff879d30000
end_va = 0x7ff879d40fff
monitored = 0
entry_point = 0x7ff879d37ea0
region_type = mapped_file
name = "dcpapi.dll"
filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll")
Region:
id = 1315
start_va = 0x7ff879d90000
end_va = 0x7ff879daefff
monitored = 0
entry_point = 0x7ff879d94960
region_type = mapped_file
name = "ncprov.dll"
filename = "\\Windows\\System32\\wbem\\NCProv.dll" (normalized: "c:\\windows\\system32\\wbem\\ncprov.dll")
Region:
id = 1316
start_va = 0x7ff879e40000
end_va = 0x7ff879e59fff
monitored = 0
entry_point = 0x7ff879e42cf0
region_type = mapped_file
name = "locationpelegacywinlocation.dll"
filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll")
Region:
id = 1317
start_va = 0x7ff879e60000
end_va = 0x7ff879e6bfff
monitored = 0
entry_point = 0x7ff879e614d0
region_type = mapped_file
name = "locationframeworkps.dll"
filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll")
Region:
id = 1318
start_va = 0x7ff879e70000
end_va = 0x7ff879ec4fff
monitored = 0
entry_point = 0x7ff879e73fb0
region_type = mapped_file
name = "policymanager.dll"
filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll")
Region:
id = 1319
start_va = 0x7ff879ed0000
end_va = 0x7ff879f06fff
monitored = 0
entry_point = 0x7ff879ed6020
region_type = mapped_file
name = "gnssadapter.dll"
filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll")
Region:
id = 1320
start_va = 0x7ff879f10000
end_va = 0x7ff879f2ffff
monitored = 0
entry_point = 0x7ff879f139a0
region_type = mapped_file
name = "locationwinpalmisc.dll"
filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll")
Region:
id = 1321
start_va = 0x7ff879f30000
end_va = 0x7ff879f70fff
monitored = 0
entry_point = 0x7ff879f34840
region_type = mapped_file
name = "usermgrproxy.dll"
filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll")
Region:
id = 1322
start_va = 0x7ff879f80000
end_va = 0x7ff87a03ffff
monitored = 0
entry_point = 0x7ff879fafd20
region_type = mapped_file
name = "fveapi.dll"
filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll")
Region:
id = 1323
start_va = 0x7ff87a040000
end_va = 0x7ff87a054fff
monitored = 0
entry_point = 0x7ff87a043460
region_type = mapped_file
name = "ssdpapi.dll"
filename = "\\Windows\\System32\\ssdpapi.dll" (normalized: "c:\\windows\\system32\\ssdpapi.dll")
Region:
id = 1324
start_va = 0x7ff87a240000
end_va = 0x7ff87a307fff
monitored = 0
entry_point = 0x7ff87a2813f0
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")
Region:
id = 1325
start_va = 0x7ff87a310000
end_va = 0x7ff87a370fff
monitored = 0
entry_point = 0x7ff87a314b50
region_type = mapped_file
name = "wlanapi.dll"
filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll")
Region:
id = 1326
start_va = 0x7ff87a380000
end_va = 0x7ff87a4fbfff
monitored = 0
entry_point = 0x7ff87a3d1650
region_type = mapped_file
name = "locationframework.dll"
filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll")
Region:
id = 1327
start_va = 0x7ff87a500000
end_va = 0x7ff87a50afff
monitored = 0
entry_point = 0x7ff87a501770
region_type = mapped_file
name = "lfsvc.dll"
filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll")
Region:
id = 1328
start_va = 0x7ff87a5b0000
end_va = 0x7ff87a5ddfff
monitored = 0
entry_point = 0x7ff87a5b7550
region_type = mapped_file
name = "netjoin.dll"
filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll")
Region:
id = 1329
start_va = 0x7ff87a5e0000
end_va = 0x7ff87a5ecfff
monitored = 0
entry_point = 0x7ff87a5e2ca0
region_type = mapped_file
name = "csystemeventsbrokerclient.dll"
filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll")
Region:
id = 1330
start_va = 0x7ff87a5f0000
end_va = 0x7ff87a61efff
monitored = 0
entry_point = 0x7ff87a5f8910
region_type = mapped_file
name = "wptaskscheduler.dll"
filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll")
Region:
id = 1331
start_va = 0x7ff87a8c0000
end_va = 0x7ff87a9a5fff
monitored = 0
entry_point = 0x7ff87a8dcf10
region_type = mapped_file
name = "usermgr.dll"
filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll")
Region:
id = 1332
start_va = 0x7ff87a9b0000
end_va = 0x7ff87a9c9fff
monitored = 0
entry_point = 0x7ff87a9b2430
region_type = mapped_file
name = "dhcpcsvc.dll"
filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")
Region:
id = 1333
start_va = 0x7ff87a9d0000
end_va = 0x7ff87a9e5fff
monitored = 0
entry_point = 0x7ff87a9d19f0
region_type = mapped_file
name = "dhcpcsvc6.dll"
filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")
Region:
id = 1334
start_va = 0x7ff87a9f0000
end_va = 0x7ff87aa27fff
monitored = 0
entry_point = 0x7ff87aa08cc0
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")
Region:
id = 1335
start_va = 0x7ff87aa30000
end_va = 0x7ff87aa3afff
monitored = 0
entry_point = 0x7ff87aa31d30
region_type = mapped_file
name = "winnsi.dll"
filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")
Region:
id = 1336
start_va = 0x7ff87aa90000
end_va = 0x7ff87aaa5fff
monitored = 0
entry_point = 0x7ff87aa91b60
region_type = mapped_file
name = "wkscli.dll"
filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")
Region:
id = 1337
start_va = 0x7ff87aae0000
end_va = 0x7ff87aaeafff
monitored = 0
entry_point = 0x7ff87aae1de0
region_type = mapped_file
name = "bitsperf.dll"
filename = "\\Windows\\System32\\bitsperf.dll" (normalized: "c:\\windows\\system32\\bitsperf.dll")
Region:
id = 1338
start_va = 0x7ff87ab50000
end_va = 0x7ff87ab66fff
monitored = 0
entry_point = 0x7ff87ab55630
region_type = mapped_file
name = "sens.dll"
filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll")
Region:
id = 1339
start_va = 0x7ff87ac20000
end_va = 0x7ff87ac33fff
monitored = 0
entry_point = 0x7ff87ac22d50
region_type = mapped_file
name = "rtutils.dll"
filename = "\\Windows\\System32\\rtutils.dll" (normalized: "c:\\windows\\system32\\rtutils.dll")
Region:
id = 1340
start_va = 0x7ff87ae80000
end_va = 0x7ff87ae9cfff
monitored = 0
entry_point = 0x7ff87ae84f60
region_type = mapped_file
name = "appinfo.dll"
filename = "\\Windows\\System32\\appinfo.dll" (normalized: "c:\\windows\\system32\\appinfo.dll")
Region:
id = 1341
start_va = 0x7ff87afb0000
end_va = 0x7ff87b042fff
monitored = 0
entry_point = 0x7ff87afb9680
region_type = mapped_file
name = "msvcp_win.dll"
filename = "\\Windows\\System32\\msvcp_win.dll" (normalized: "c:\\windows\\system32\\msvcp_win.dll")
Region:
id = 1342
start_va = 0x7ff87b160000
end_va = 0x7ff87b178fff
monitored = 0
entry_point = 0x7ff87b164520
region_type = mapped_file
name = "samcli.dll"
filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll")
Region:
id = 1343
start_va = 0x7ff87b670000
end_va = 0x7ff87b6ddfff
monitored = 0
entry_point = 0x7ff87b677f60
region_type = mapped_file
name = "taskcomp.dll"
filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll")
Region:
id = 1344
start_va = 0x7ff87b6e0000
end_va = 0x7ff87b6effff
monitored = 0
entry_point = 0x7ff87b6e2c60
region_type = mapped_file
name = "usermgrcli.dll"
filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll")
Region:
id = 1345
start_va = 0x7ff87b6f0000
end_va = 0x7ff87b700fff
monitored = 0
entry_point = 0x7ff87b6f3320
region_type = mapped_file
name = "wmiclnt.dll"
filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll")
Region:
id = 1346
start_va = 0x7ff87b750000
end_va = 0x7ff87b7e1fff
monitored = 0
entry_point = 0x7ff87b79a780
region_type = mapped_file
name = "msvcp110_win.dll"
filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll")
Region:
id = 1347
start_va = 0x7ff87bb00000
end_va = 0x7ff87be81fff
monitored = 0
entry_point = 0x7ff87bb51220
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")
Region:
id = 1348
start_va = 0x7ff87be90000
end_va = 0x7ff87bfc5fff
monitored = 0
entry_point = 0x7ff87bebf350
region_type = mapped_file
name = "wintypes.dll"
filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll")
Region:
id = 1349
start_va = 0x7ff87d0c0000
end_va = 0x7ff87d1cdfff
monitored = 0
entry_point = 0x7ff87d10eaa0
region_type = mapped_file
name = "mrmcorer.dll"
filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll")
Region:
id = 1350
start_va = 0x7ff87d4d0000
end_va = 0x7ff87d510fff
monitored = 0
entry_point = 0x7ff87d4e7eb0
region_type = mapped_file
name = "ubpm.dll"
filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll")
Region:
id = 1351
start_va = 0x7ff87d520000
end_va = 0x7ff87d61bfff
monitored = 0
entry_point = 0x7ff87d556df0
region_type = mapped_file
name = "schedsvc.dll"
filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll")
Region:
id = 1352
start_va = 0x7ff87d6e0000
end_va = 0x7ff87d6e8fff
monitored = 0
entry_point = 0x7ff87d6e21d0
region_type = mapped_file
name = "httpprxc.dll"
filename = "\\Windows\\System32\\httpprxc.dll" (normalized: "c:\\windows\\system32\\httpprxc.dll")
Region:
id = 1353
start_va = 0x7ff87d6f0000
end_va = 0x7ff87d6fbfff
monitored = 0
entry_point = 0x7ff87d6f2830
region_type = mapped_file
name = "bi.dll"
filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll")
Region:
id = 1354
start_va = 0x7ff87d700000
end_va = 0x7ff87d712fff
monitored = 0
entry_point = 0x7ff87d7057f0
region_type = mapped_file
name = "themeservice.dll"
filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll")
Region:
id = 1355
start_va = 0x7ff87d720000
end_va = 0x7ff87d75dfff
monitored = 0
entry_point = 0x7ff87d72a050
region_type = mapped_file
name = "logoncli.dll"
filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll")
Region:
id = 1356
start_va = 0x7ff87d760000
end_va = 0x7ff87d786fff
monitored = 0
entry_point = 0x7ff87d763bf0
region_type = mapped_file
name = "profsvcext.dll"
filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll")
Region:
id = 1357
start_va = 0x7ff87d790000
end_va = 0x7ff87d7e4fff
monitored = 0
entry_point = 0x7ff87d79fc00
region_type = mapped_file
name = "profsvc.dll"
filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll")
Region:
id = 1358
start_va = 0x7ff87d7f0000
end_va = 0x7ff87d853fff
monitored = 0
entry_point = 0x7ff87d805ae0
region_type = mapped_file
name = "wevtapi.dll"
filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")
Region:
id = 1359
start_va = 0x7ff87da20000
end_va = 0x7ff87dadefff
monitored = 0
entry_point = 0x7ff87da41c50
region_type = mapped_file
name = "taskschd.dll"
filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll")
Region:
id = 1360
start_va = 0x7ff87dae0000
end_va = 0x7ff87db08fff
monitored = 0
entry_point = 0x7ff87daeca00
region_type = mapped_file
name = "cabinet.dll"
filename = "\\Windows\\System32\\cabinet.dll" (normalized: "c:\\windows\\system32\\cabinet.dll")
Region:
id = 1361
start_va = 0x7ff87db10000
end_va = 0x7ff87db45fff
monitored = 0
entry_point = 0x7ff87db20070
region_type = mapped_file
name = "xmllite.dll"
filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")
Region:
id = 1362
start_va = 0x7ff87e310000
end_va = 0x7ff87e34ffff
monitored = 0
entry_point = 0x7ff87e326c60
region_type = mapped_file
name = "netprofm.dll"
filename = "\\Windows\\System32\\netprofm.dll" (normalized: "c:\\windows\\system32\\netprofm.dll")
Region:
id = 1363
start_va = 0x7ff87e3f0000
end_va = 0x7ff87e401fff
monitored = 0
entry_point = 0x7ff87e3f1a80
region_type = mapped_file
name = "bitsproxy.dll"
filename = "\\Windows\\System32\\BitsProxy.dll" (normalized: "c:\\windows\\system32\\bitsproxy.dll")
Region:
id = 1364
start_va = 0x7ff87e420000
end_va = 0x7ff87e429fff
monitored = 0
entry_point = 0x7ff87e421660
region_type = mapped_file
name = "dsrole.dll"
filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")
Region:
id = 1365
start_va = 0x7ff87e430000
end_va = 0x7ff87e447fff
monitored = 0
entry_point = 0x7ff87e435910
region_type = mapped_file
name = "nlaapi.dll"
filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")
Region:
id = 1366
start_va = 0x7ff87e450000
end_va = 0x7ff87e59cfff
monitored = 0
entry_point = 0x7ff87e493da0
region_type = mapped_file
name = "gpsvc.dll"
filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll")
Region:
id = 1367
start_va = 0x7ff87ebb0000
end_va = 0x7ff87ebb7fff
monitored = 0
entry_point = 0x7ff87ebb13e0
region_type = mapped_file
name = "dabapi.dll"
filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll")
Region:
id = 1368
start_va = 0x7ff87f0a0000
end_va = 0x7ff87f0dffff
monitored = 0
entry_point = 0x7ff87f0b1960
region_type = mapped_file
name = "brokerlib.dll"
filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll")
Region:
id = 1369
start_va = 0x7ff87f150000
end_va = 0x7ff87f1c8fff
monitored = 0
entry_point = 0x7ff87f16fb90
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")
Region:
id = 1370
start_va = 0x7ff87f380000
end_va = 0x7ff87f812fff
monitored = 0
entry_point = 0x7ff87f38f760
region_type = mapped_file
name = "actxprxy.dll"
filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")
Region:
id = 1371
start_va = 0x7ff87f820000
end_va = 0x7ff87f886fff
monitored = 0
entry_point = 0x7ff87f83e710
region_type = mapped_file
name = "bcp47langs.dll"
filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll")
Region:
id = 1372
start_va = 0x7ff87f8e0000
end_va = 0x7ff87fa65fff
monitored = 0
entry_point = 0x7ff87f92d700
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")
Region:
id = 1373
start_va = 0x7ff87fa70000
end_va = 0x7ff87fa8bfff
monitored = 0
entry_point = 0x7ff87fa737a0
region_type = mapped_file
name = "samlib.dll"
filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll")
Region:
id = 1374
start_va = 0x7ff87fad0000
end_va = 0x7ff87fae2fff
monitored = 0
entry_point = 0x7ff87fad2760
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")
Region:
id = 1375
start_va = 0x7ff87fc60000
end_va = 0x7ff87fcf5fff
monitored = 0
entry_point = 0x7ff87fc85570
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 1376
start_va = 0x7ff87fd00000
end_va = 0x7ff87fd26fff
monitored = 0
entry_point = 0x7ff87fd07940
region_type = mapped_file
name = "devobj.dll"
filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")
Region:
id = 1377
start_va = 0x7ff87fd50000
end_va = 0x7ff87fdf9fff
monitored = 0
entry_point = 0x7ff87fd77910
region_type = mapped_file
name = "dnsapi.dll"
filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")
Region:
id = 1378
start_va = 0x7ff87fe00000
end_va = 0x7ff87fefffff
monitored = 0
entry_point = 0x7ff87fe40f80
region_type = mapped_file
name = "twinapi.appcore.dll"
filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll")
Region:
id = 1379
start_va = 0x7ff87ff90000
end_va = 0x7ff87ff9bfff
monitored = 0
entry_point = 0x7ff87ff92480
region_type = mapped_file
name = "sysntfy.dll"
filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll")
Region:
id = 1380
start_va = 0x7ff880060000
end_va = 0x7ff880091fff
monitored = 0
entry_point = 0x7ff880072340
region_type = mapped_file
name = "fwbase.dll"
filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll")
Region:
id = 1381
start_va = 0x7ff8802d0000
end_va = 0x7ff8802dbfff
monitored = 0
entry_point = 0x7ff8802d2790
region_type = mapped_file
name = "hid.dll"
filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll")
Region:
id = 1382
start_va = 0x7ff8802e0000
end_va = 0x7ff880303fff
monitored = 0
entry_point = 0x7ff8802e3260
region_type = mapped_file
name = "gpapi.dll"
filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")
Region:
id = 1383
start_va = 0x7ff880480000
end_va = 0x7ff880573fff
monitored = 0
entry_point = 0x7ff88048a960
region_type = mapped_file
name = "ucrtbase.dll"
filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")
Region:
id = 1384
start_va = 0x7ff8805d0000
end_va = 0x7ff880618fff
monitored = 0
entry_point = 0x7ff8805da090
region_type = mapped_file
name = "authz.dll"
filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll")
Region:
id = 1385
start_va = 0x7ff8806f0000
end_va = 0x7ff8806fbfff
monitored = 0
entry_point = 0x7ff8806f27e0
region_type = mapped_file
name = "netutils.dll"
filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")
Region:
id = 1386
start_va = 0x7ff8807d0000
end_va = 0x7ff880800fff
monitored = 0
entry_point = 0x7ff8807d7d10
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")
Region:
id = 1387
start_va = 0x7ff880830000
end_va = 0x7ff8808a9fff
monitored = 0
entry_point = 0x7ff880851a50
region_type = mapped_file
name = "schannel.dll"
filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll")
Region:
id = 1388
start_va = 0x7ff8808f0000
end_va = 0x7ff880923fff
monitored = 0
entry_point = 0x7ff88090ae70
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 1389
start_va = 0x7ff880930000
end_va = 0x7ff880939fff
monitored = 0
entry_point = 0x7ff880931830
region_type = mapped_file
name = "dpapi.dll"
filename = "\\Windows\\System32\\dpapi.dll" (normalized: "c:\\windows\\system32\\dpapi.dll")
Region:
id = 1390
start_va = 0x7ff880a40000
end_va = 0x7ff880a5efff
monitored = 0
entry_point = 0x7ff880a45d30
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")
Region:
id = 1391
start_va = 0x7ff880bb0000
end_va = 0x7ff880c0bfff
monitored = 0
entry_point = 0x7ff880bc6f70
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")
Region:
id = 1392
start_va = 0x7ff880c60000
end_va = 0x7ff880c76fff
monitored = 0
entry_point = 0x7ff880c679d0
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")
Region:
id = 1393
start_va = 0x7ff880d80000
end_va = 0x7ff880d8afff
monitored = 0
entry_point = 0x7ff880d819a0
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 1394
start_va = 0x7ff880dc0000
end_va = 0x7ff880de0fff
monitored = 0
entry_point = 0x7ff880dd0250
region_type = mapped_file
name = "joinutil.dll"
filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll")
Region:
id = 1395
start_va = 0x7ff880e10000
end_va = 0x7ff880e49fff
monitored = 0
entry_point = 0x7ff880e18d20
region_type = mapped_file
name = "ntasn1.dll"
filename = "\\Windows\\System32\\ntasn1.dll" (normalized: "c:\\windows\\system32\\ntasn1.dll")
Region:
id = 1396
start_va = 0x7ff880e50000
end_va = 0x7ff880e76fff
monitored = 0
entry_point = 0x7ff880e60aa0
region_type = mapped_file
name = "ncrypt.dll"
filename = "\\Windows\\System32\\ncrypt.dll" (normalized: "c:\\windows\\system32\\ncrypt.dll")
Region:
id = 1397
start_va = 0x7ff880f60000
end_va = 0x7ff880f8cfff
monitored = 0
entry_point = 0x7ff880f79d40
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 1398
start_va = 0x7ff8810f0000
end_va = 0x7ff881145fff
monitored = 0
entry_point = 0x7ff881100bf0
region_type = mapped_file
name = "winsta.dll"
filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")
Region:
id = 1399
start_va = 0x7ff881150000
end_va = 0x7ff881168fff
monitored = 0
entry_point = 0x7ff881155e10
region_type = mapped_file
name = "eventaggregation.dll"
filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll")
Region:
id = 1400
start_va = 0x7ff881170000
end_va = 0x7ff881198fff
monitored = 0
entry_point = 0x7ff881184530
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 1401
start_va = 0x7ff8811a0000
end_va = 0x7ff881238fff
monitored = 0
entry_point = 0x7ff8811cf4e0
region_type = mapped_file
name = "sxs.dll"
filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")
Region:
id = 1402
start_va = 0x7ff8812e0000
end_va = 0x7ff88132afff
monitored = 0
entry_point = 0x7ff8812e35f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 1403
start_va = 0x7ff881330000
end_va = 0x7ff88133efff
monitored = 0
entry_point = 0x7ff881333210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 1404
start_va = 0x7ff881340000
end_va = 0x7ff881353fff
monitored = 0
entry_point = 0x7ff8813452e0
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 1405
start_va = 0x7ff881360000
end_va = 0x7ff88136ffff
monitored = 0
entry_point = 0x7ff8813656e0
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 1406
start_va = 0x7ff881370000
end_va = 0x7ff8813b2fff
monitored = 0
entry_point = 0x7ff881384b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 1407
start_va = 0x7ff8813c0000
end_va = 0x7ff881445fff
monitored = 0
entry_point = 0x7ff8813cd8f0
region_type = mapped_file
name = "firewallapi.dll"
filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll")
Region:
id = 1408
start_va = 0x7ff881450000
end_va = 0x7ff881616fff
monitored = 0
entry_point = 0x7ff8814adb80
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 1409
start_va = 0x7ff881620000
end_va = 0x7ff881c63fff
monitored = 0
entry_point = 0x7ff8817e64b0
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")
Region:
id = 1410
start_va = 0x7ff881c70000
end_va = 0x7ff881d24fff
monitored = 0
entry_point = 0x7ff881cb22e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 1411
start_va = 0x7ff881d30000
end_va = 0x7ff881d46fff
monitored = 0
entry_point = 0x7ff881d31390
region_type = mapped_file
name = "netapi32.dll"
filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll")
Region:
id = 1412
start_va = 0x7ff881d50000
end_va = 0x7ff881db9fff
monitored = 0
entry_point = 0x7ff881d86d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 1413
start_va = 0x7ff881e70000
end_va = 0x7ff881ec4fff
monitored = 0
entry_point = 0x7ff881e87970
region_type = mapped_file
name = "wintrust.dll"
filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")
Region:
id = 1414
start_va = 0x7ff881ed0000
end_va = 0x7ff8820b7fff
monitored = 0
entry_point = 0x7ff881efba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 1415
start_va = 0x7ff8820c0000
end_va = 0x7ff882215fff
monitored = 0
entry_point = 0x7ff8820ca8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 1416
start_va = 0x7ff882220000
end_va = 0x7ff8822bcfff
monitored = 0
entry_point = 0x7ff8822278a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 1417
start_va = 0x7ff8822c0000
end_va = 0x7ff88253cfff
monitored = 0
entry_point = 0x7ff882394970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 1418
start_va = 0x7ff882550000
end_va = 0x7ff8825aafff
monitored = 0
entry_point = 0x7ff8825638b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 1419
start_va = 0x7ff8825b0000
end_va = 0x7ff883b0efff
monitored = 0
entry_point = 0x7ff8827111f0
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 1420
start_va = 0x7ff883b80000
end_va = 0x7ff883beafff
monitored = 0
entry_point = 0x7ff883b990c0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 1421
start_va = 0x7ff883bf0000
end_va = 0x7ff883d0bfff
monitored = 0
entry_point = 0x7ff883c302b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 1422
start_va = 0x7ff884020000
end_va = 0x7ff88407bfff
monitored = 0
entry_point = 0x7ff88403b720
region_type = mapped_file
name = "wldap32.dll"
filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")
Region:
id = 1423
start_va = 0x7ff8841b0000
end_va = 0x7ff884256fff
monitored = 0
entry_point = 0x7ff8841bb4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 1424
start_va = 0x7ff8842c0000
end_va = 0x7ff884402fff
monitored = 0
entry_point = 0x7ff8842e8210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 1425
start_va = 0x7ff884410000
end_va = 0x7ff8844d0fff
monitored = 0
entry_point = 0x7ff884430da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 1426
start_va = 0x7ff8844f0000
end_va = 0x7ff884918fff
monitored = 0
entry_point = 0x7ff884518740
region_type = mapped_file
name = "setupapi.dll"
filename = "\\Windows\\System32\\setupapi.dll" (normalized: "c:\\windows\\system32\\setupapi.dll")
Region:
id = 1427
start_va = 0x7ff884920000
end_va = 0x7ff8849c6fff
monitored = 0
entry_point = 0x7ff8849358d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 1428
start_va = 0x7ff884a10000
end_va = 0x7ff884b95fff
monitored = 0
entry_point = 0x7ff884a5ffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 1429
start_va = 0x7ff884ba0000
end_va = 0x7ff884ba7fff
monitored = 0
entry_point = 0x7ff884ba1ea0
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")
Region:
id = 1430
start_va = 0x7ff884bb0000
end_va = 0x7ff884c01fff
monitored = 0
entry_point = 0x7ff884bbf530
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 1431
start_va = 0x7ff884c10000
end_va = 0x7ff884cbcfff
monitored = 0
entry_point = 0x7ff884c281a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 1432
start_va = 0x7ff884cc0000
end_va = 0x7ff884e80fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1679
start_va = 0xac00000
end_va = 0xacfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000ac00000"
filename = ""
Region:
id = 1680
start_va = 0xad00000
end_va = 0xadfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000ad00000"
filename = ""
Region:
id = 1681
start_va = 0xae00000
end_va = 0xaefffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000ae00000"
filename = ""
Region:
id = 1682
start_va = 0xaf00000
end_va = 0xaffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000af00000"
filename = ""
Region:
id = 1772
start_va = 0x4b80000
end_va = 0x4b82fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004b80000"
filename = ""
Region:
id = 1885
start_va = 0xb000000
end_va = 0xb0fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b000000"
filename = ""
Region:
id = 1962
start_va = 0xb100000
end_va = 0xb1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b100000"
filename = ""
Region:
id = 1963
start_va = 0xb200000
end_va = 0xb2fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b200000"
filename = ""
Region:
id = 1964
start_va = 0xb300000
end_va = 0xb3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000000b300000"
filename = ""
Region:
id = 2030
start_va = 0x4b80000
end_va = 0x4bfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004b80000"
filename = ""
Region:
id = 2031
start_va = 0x6600000
end_va = 0x667ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000006600000"
filename = ""
Region:
id = 2032
start_va = 0x7ff87d630000
end_va = 0x7ff87d6a9fff
monitored = 0
entry_point = 0x7ff87d657630
region_type = mapped_file
name = "es.dll"
filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")
Region:
id = 2033
start_va = 0x5010000
end_va = 0x5011fff
monitored = 0
entry_point = 0x5015630
region_type = mapped_file
name = "sens.dll"
filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll")
Region:
id = 2034
start_va = 0x5020000
end_va = 0x5024fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "stdole2.tlb"
filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb")
Region:
id = 2035
start_va = 0x7ff87f280000
end_va = 0x7ff87f2d0fff
monitored = 0
entry_point = 0x7ff87f2825e0
region_type = mapped_file
name = "cscobj.dll"
filename = "\\Windows\\System32\\cscobj.dll" (normalized: "c:\\windows\\system32\\cscobj.dll")
Region:
id = 2036
start_va = 0x7700000
end_va = 0x77fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007700000"
filename = ""
Region:
id = 2037
start_va = 0x1b40000
end_va = 0x1b41fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001b40000"
filename = ""
Region:
id = 2038
start_va = 0x1b50000
end_va = 0x1b51fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001b50000"
filename = ""
Region:
id = 2039
start_va = 0x1b60000
end_va = 0x1b61fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001b60000"
filename = ""
Region:
id = 2040
start_va = 0x1b50000
end_va = 0x1b53fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001b50000"
filename = ""
Region:
id = 2041
start_va = 0x1b50000
end_va = 0x1b50fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001b50000"
filename = ""
Region:
id = 2042
start_va = 0x1b50000
end_va = 0x1b50fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001b50000"
filename = ""
Region:
id = 2043
start_va = 0x1b70000
end_va = 0x1beffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001b70000"
filename = ""
Thread:
id = 26
os_tid = 0x728
Thread:
id = 27
os_tid = 0x9f4
Thread:
id = 28
os_tid = 0xee8
Thread:
id = 29
os_tid = 0x314
Thread:
id = 30
os_tid = 0xc88
Thread:
id = 31
os_tid = 0x13d8
Thread:
id = 32
os_tid = 0x1378
Thread:
id = 33
os_tid = 0x1374
Thread:
id = 34
os_tid = 0x1320
Thread:
id = 35
os_tid = 0x1310
Thread:
id = 36
os_tid = 0x1300
Thread:
id = 37
os_tid = 0x12fc
Thread:
id = 38
os_tid = 0x1250
Thread:
id = 39
os_tid = 0x1220
Thread:
id = 40
os_tid = 0x1218
Thread:
id = 41
os_tid = 0x120c
Thread:
id = 42
os_tid = 0x11fc
Thread:
id = 43
os_tid = 0x11c8
Thread:
id = 44
os_tid = 0x1170
Thread:
id = 45
os_tid = 0xbdc
Thread:
id = 46
os_tid = 0x22c
Thread:
id = 47
os_tid = 0xff4
Thread:
id = 48
os_tid = 0x3c4
Thread:
id = 49
os_tid = 0xf74
Thread:
id = 50
os_tid = 0xfa4
Thread:
id = 51
os_tid = 0xfa8
Thread:
id = 52
os_tid = 0xf90
Thread:
id = 53
os_tid = 0xf78
Thread:
id = 54
os_tid = 0xfb8
Thread:
id = 55
os_tid = 0xeb4
Thread:
id = 56
os_tid = 0x234
Thread:
id = 57
os_tid = 0xe60
Thread:
id = 58
os_tid = 0xca8
Thread:
id = 59
os_tid = 0xe70
Thread:
id = 60
os_tid = 0xe58
Thread:
id = 61
os_tid = 0xc58
Thread:
id = 62
os_tid = 0xd8c
Thread:
id = 63
os_tid = 0xdb8
Thread:
id = 64
os_tid = 0xda4
Thread:
id = 65
os_tid = 0xd98
Thread:
id = 66
os_tid = 0xd1c
Thread:
id = 67
os_tid = 0x714
Thread:
id = 68
os_tid = 0xa78
Thread:
id = 69
os_tid = 0xa70
Thread:
id = 70
os_tid = 0xa68
Thread:
id = 71
os_tid = 0xa64
Thread:
id = 72
os_tid = 0xa60
Thread:
id = 73
os_tid = 0x96c
Thread:
id = 74
os_tid = 0x95c
Thread:
id = 75
os_tid = 0x94c
Thread:
id = 76
os_tid = 0x90c
Thread:
id = 77
os_tid = 0x8dc
Thread:
id = 78
os_tid = 0x8d8
Thread:
id = 79
os_tid = 0x8c8
Thread:
id = 80
os_tid = 0x8c4
Thread:
id = 81
os_tid = 0x884
Thread:
id = 82
os_tid = 0x85c
Thread:
id = 83
os_tid = 0x4bc
Thread:
id = 84
os_tid = 0x7cc
Thread:
id = 85
os_tid = 0x600
Thread:
id = 86
os_tid = 0x4d0
Thread:
id = 87
os_tid = 0x508
Thread:
id = 88
os_tid = 0x710
Thread:
id = 89
os_tid = 0x704
Thread:
id = 90
os_tid = 0x660
Thread:
id = 91
os_tid = 0x5ec
Thread:
id = 92
os_tid = 0x56c
Thread:
id = 93
os_tid = 0x568
Thread:
id = 94
os_tid = 0x504
Thread:
id = 95
os_tid = 0x4ac
Thread:
id = 96
os_tid = 0x49c
Thread:
id = 97
os_tid = 0x44c
Thread:
id = 98
os_tid = 0x420
Thread:
id = 99
os_tid = 0x40c
Thread:
id = 100
os_tid = 0x168
Thread:
id = 101
os_tid = 0x304
Thread:
id = 102
os_tid = 0x280
Thread:
id = 103
os_tid = 0x1b8
Thread:
id = 104
os_tid = 0x188
Thread:
id = 105
os_tid = 0x3f8
Thread:
id = 106
os_tid = 0x3ec
Thread:
id = 107
os_tid = 0x3d8
Thread:
id = 108
os_tid = 0x364
Thread:
id = 137
os_tid = 0xef8
Thread:
id = 138
os_tid = 0x60c
Thread:
id = 139
os_tid = 0xc4c
Thread:
id = 140
os_tid = 0xd88
Thread:
id = 144
os_tid = 0x111c
Thread:
id = 147
os_tid = 0xf1c
Thread:
id = 148
os_tid = 0xbc0
Thread:
id = 149
os_tid = 0x6f0
Thread:
id = 150
os_tid = 0x700
Thread:
id = 151
os_tid = 0x440
Thread:
id = 152
os_tid = 0x6e4
Thread:
id = 153
os_tid = 0xb0c
Thread:
id = 154
os_tid = 0x920
Thread:
id = 157
os_tid = 0x103c
Process:
id = "7"
image_name = "7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe"
filename = "c:\\users\\rdhj0cnfevzx\\desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe"
page_root = "0x47f60000"
os_pid = "0x13ac"
os_integrity_level = "0x3000"
os_privileges = "0x60800000"
monitor_reason = "child_process"
parent_id = "1"
os_parent_pid = "0x6d8"
cmd_line = "\"C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe\""
cur_dir = "C:\\Users\\RDhJ0CNFevzX\\Desktop\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000f600" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 1482
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 1483
start_va = 0x30000
end_va = 0x31fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 1484
start_va = 0x40000
end_va = 0x54fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000040000"
filename = ""
Region:
id = 1485
start_va = 0x60000
end_va = 0x9ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000060000"
filename = ""
Region:
id = 1486
start_va = 0xa0000
end_va = 0x19ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000a0000"
filename = ""
Region:
id = 1487
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 1488
start_va = 0x400000
end_va = 0x489fff
monitored = 1
entry_point = 0x48405a
region_type = mapped_file
name = "7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe"
filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe")
Region:
id = 1489
start_va = 0x77460000
end_va = 0x775dafff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\SysWOW64\\ntdll.dll" (normalized: "c:\\windows\\syswow64\\ntdll.dll")
Region:
id = 1490
start_va = 0x7ffb0000
end_va = 0x7ffd2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007ffb0000"
filename = ""
Region:
id = 1491
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 1492
start_va = 0x7fff0000
end_va = 0x7ff884cbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fff0000"
filename = ""
Region:
id = 1493
start_va = 0x7ff884cc0000
end_va = 0x7ff884e80fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1494
start_va = 0x7ff884e81000
end_va = 0x7ffffffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00007ff884e81000"
filename = ""
Region:
id = 1496
start_va = 0x1a0000
end_va = 0x1a3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001a0000"
filename = ""
Region:
id = 1497
start_va = 0x1b0000
end_va = 0x1b0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001b0000"
filename = ""
Region:
id = 1498
start_va = 0x1c0000
end_va = 0x1c1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 1499
start_va = 0x400000
end_va = 0x439fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 1506
start_va = 0x1f0000
end_va = 0x1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001f0000"
filename = ""
Region:
id = 1507
start_va = 0x5f960000
end_va = 0x5f9affff
monitored = 0
entry_point = 0x5f978180
region_type = mapped_file
name = "wow64.dll"
filename = "\\Windows\\System32\\wow64.dll" (normalized: "c:\\windows\\system32\\wow64.dll")
Region:
id = 1508
start_va = 0x5f9b0000
end_va = 0x5fa29fff
monitored = 0
entry_point = 0x5f9c3290
region_type = mapped_file
name = "wow64win.dll"
filename = "\\Windows\\System32\\wow64win.dll" (normalized: "c:\\windows\\system32\\wow64win.dll")
Region:
id = 1509
start_va = 0x76410000
end_va = 0x764effff
monitored = 0
entry_point = 0x76423980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 1510
start_va = 0x5fa30000
end_va = 0x5fa37fff
monitored = 0
entry_point = 0x5fa317c0
region_type = mapped_file
name = "wow64cpu.dll"
filename = "\\Windows\\System32\\wow64cpu.dll" (normalized: "c:\\windows\\system32\\wow64cpu.dll")
Region:
id = 1511
start_va = 0x440000
end_va = 0x5affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000440000"
filename = ""
Region:
id = 1512
start_va = 0x6e740000
end_va = 0x6e798fff
monitored = 1
entry_point = 0x6e750780
region_type = mapped_file
name = "mscoree.dll"
filename = "\\Windows\\SysWOW64\\mscoree.dll" (normalized: "c:\\windows\\syswow64\\mscoree.dll")
Region:
id = 1513
start_va = 0x76410000
end_va = 0x764effff
monitored = 0
entry_point = 0x76423980
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\SysWOW64\\kernel32.dll" (normalized: "c:\\windows\\syswow64\\kernel32.dll")
Region:
id = 1514
start_va = 0x77270000
end_va = 0x773edfff
monitored = 0
entry_point = 0x77321b90
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\SysWOW64\\KernelBase.dll" (normalized: "c:\\windows\\syswow64\\kernelbase.dll")
Region:
id = 1515
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 1516
start_va = 0x7feb0000
end_va = 0x7ffaffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x000000007feb0000"
filename = ""
Region:
id = 1517
start_va = 0x5b0000
end_va = 0x66dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1518
start_va = 0x670000
end_va = 0x81ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000670000"
filename = ""
Region:
id = 1521
start_va = 0x20000
end_va = 0x23fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 1522
start_va = 0x76b70000
end_va = 0x76beafff
monitored = 0
entry_point = 0x76b8e970
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\SysWOW64\\advapi32.dll" (normalized: "c:\\windows\\syswow64\\advapi32.dll")
Region:
id = 1523
start_va = 0x76570000
end_va = 0x7662dfff
monitored = 0
entry_point = 0x765a5630
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\SysWOW64\\msvcrt.dll" (normalized: "c:\\windows\\syswow64\\msvcrt.dll")
Region:
id = 1524
start_va = 0x440000
end_va = 0x47ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000440000"
filename = ""
Region:
id = 1525
start_va = 0x4b0000
end_va = 0x5affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004b0000"
filename = ""
Region:
id = 1526
start_va = 0x670000
end_va = 0x76ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000670000"
filename = ""
Region:
id = 1527
start_va = 0x810000
end_va = 0x81ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000810000"
filename = ""
Region:
id = 1528
start_va = 0x758e0000
end_va = 0x75923fff
monitored = 0
entry_point = 0x758f9d80
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\SysWOW64\\sechost.dll" (normalized: "c:\\windows\\syswow64\\sechost.dll")
Region:
id = 1529
start_va = 0x76630000
end_va = 0x766dcfff
monitored = 0
entry_point = 0x76644f00
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\SysWOW64\\rpcrt4.dll" (normalized: "c:\\windows\\syswow64\\rpcrt4.dll")
Region:
id = 1530
start_va = 0x74190000
end_va = 0x741adfff
monitored = 0
entry_point = 0x7419b640
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\SysWOW64\\sspicli.dll" (normalized: "c:\\windows\\syswow64\\sspicli.dll")
Region:
id = 1531
start_va = 0x74180000
end_va = 0x74189fff
monitored = 0
entry_point = 0x74182a00
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\SysWOW64\\cryptbase.dll" (normalized: "c:\\windows\\syswow64\\cryptbase.dll")
Region:
id = 1532
start_va = 0x75880000
end_va = 0x758d7fff
monitored = 0
entry_point = 0x758c25c0
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\SysWOW64\\bcryptprimitives.dll" (normalized: "c:\\windows\\syswow64\\bcryptprimitives.dll")
Region:
id = 1533
start_va = 0x820000
end_va = 0x8fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000820000"
filename = ""
Region:
id = 1536
start_va = 0x6c6a0000
end_va = 0x6c718fff
monitored = 1
entry_point = 0x6c6af82a
region_type = mapped_file
name = "mscoreei.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscoreei.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\mscoreei.dll")
Region:
id = 1537
start_va = 0x76ed0000
end_va = 0x76f14fff
monitored = 0
entry_point = 0x76eede90
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\SysWOW64\\shlwapi.dll" (normalized: "c:\\windows\\syswow64\\shlwapi.dll")
Region:
id = 1538
start_va = 0x769b0000
end_va = 0x76b6cfff
monitored = 0
entry_point = 0x76a92a10
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\SysWOW64\\combase.dll" (normalized: "c:\\windows\\syswow64\\combase.dll")
Region:
id = 1539
start_va = 0x76d80000
end_va = 0x76ecefff
monitored = 0
entry_point = 0x76e36820
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\SysWOW64\\gdi32.dll" (normalized: "c:\\windows\\syswow64\\gdi32.dll")
Region:
id = 1540
start_va = 0x755e0000
end_va = 0x75726fff
monitored = 0
entry_point = 0x755f1cf0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\SysWOW64\\user32.dll" (normalized: "c:\\windows\\syswow64\\user32.dll")
Region:
id = 1541
start_va = 0x480000
end_va = 0x4a9fff
monitored = 0
entry_point = 0x485680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 1542
start_va = 0x900000
end_va = 0xa87fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000900000"
filename = ""
Region:
id = 1543
start_va = 0x764f0000
end_va = 0x7651afff
monitored = 0
entry_point = 0x764f5680
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\SysWOW64\\imm32.dll" (normalized: "c:\\windows\\syswow64\\imm32.dll")
Region:
id = 1544
start_va = 0x30000
end_va = 0x30fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000030000"
filename = ""
Region:
id = 1545
start_va = 0x1d0000
end_va = 0x1d0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001d0000"
filename = ""
Region:
id = 1546
start_va = 0xa90000
end_va = 0xc10fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000a90000"
filename = ""
Region:
id = 1547
start_va = 0xc20000
end_va = 0x201ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000c20000"
filename = ""
Region:
id = 1548
start_va = 0x770000
end_va = 0x7f2fff
monitored = 1
entry_point = 0x7f405a
region_type = mapped_file
name = "7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe"
filename = "\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe")
Region:
id = 1549
start_va = 0x755d0000
end_va = 0x755dbfff
monitored = 0
entry_point = 0x755d3930
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\SysWOW64\\kernel.appcore.dll" (normalized: "c:\\windows\\syswow64\\kernel.appcore.dll")
Region:
id = 1550
start_va = 0x71780000
end_va = 0x71787fff
monitored = 0
entry_point = 0x717817b0
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\SysWOW64\\version.dll" (normalized: "c:\\windows\\syswow64\\version.dll")
Region:
id = 1551
start_va = 0x6bfe0000
end_va = 0x6c690fff
monitored = 1
entry_point = 0x6bff5d20
region_type = mapped_file
name = "clr.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clr.dll")
Region:
id = 1552
start_va = 0x71680000
end_va = 0x71774fff
monitored = 0
entry_point = 0x716d4160
region_type = mapped_file
name = "msvcr120_clr0400.dll"
filename = "\\Windows\\SysWOW64\\msvcr120_clr0400.dll" (normalized: "c:\\windows\\syswow64\\msvcr120_clr0400.dll")
Region:
id = 1553
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001e0000"
filename = ""
Region:
id = 1554
start_va = 0x480000
end_va = 0x48ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000480000"
filename = ""
Region:
id = 1555
start_va = 0x490000
end_va = 0x49ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000490000"
filename = ""
Region:
id = 1556
start_va = 0x4a0000
end_va = 0x4affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004a0000"
filename = ""
Region:
id = 1557
start_va = 0x770000
end_va = 0x77ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000770000"
filename = ""
Region:
id = 1558
start_va = 0x780000
end_va = 0x78ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000780000"
filename = ""
Region:
id = 1559
start_va = 0x790000
end_va = 0x79ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000790000"
filename = ""
Region:
id = 1560
start_va = 0x7a0000
end_va = 0x7a0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000007a0000"
filename = ""
Region:
id = 1561
start_va = 0x7b0000
end_va = 0x7b0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000007b0000"
filename = ""
Region:
id = 1562
start_va = 0x2020000
end_va = 0x21fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002020000"
filename = ""
Region:
id = 1563
start_va = 0x2020000
end_va = 0x212ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002020000"
filename = ""
Region:
id = 1564
start_va = 0x21f0000
end_va = 0x21fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000021f0000"
filename = ""
Region:
id = 1565
start_va = 0x7c0000
end_va = 0x7fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000007c0000"
filename = ""
Region:
id = 1566
start_va = 0x2020000
end_va = 0x211ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002020000"
filename = ""
Region:
id = 1567
start_va = 0x2120000
end_va = 0x212ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002120000"
filename = ""
Region:
id = 1568
start_va = 0x800000
end_va = 0x80ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000800000"
filename = ""
Region:
id = 1569
start_va = 0x2200000
end_va = 0x41fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002200000"
filename = ""
Region:
id = 1570
start_va = 0x820000
end_va = 0x8bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000820000"
filename = ""
Region:
id = 1571
start_va = 0x8f0000
end_va = 0x8fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008f0000"
filename = ""
Region:
id = 1572
start_va = 0x2130000
end_va = 0x216ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002130000"
filename = ""
Region:
id = 1573
start_va = 0x4200000
end_va = 0x42fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004200000"
filename = ""
Region:
id = 1574
start_va = 0x4300000
end_va = 0x4636fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1575
start_va = 0x6adb0000
end_va = 0x6bfd7fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "mscorlib.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\mscorlib\\8062d427acd64e37f4fded7b00f4a869\\mscorlib.ni.dll")
Region:
id = 1576
start_va = 0x767c0000
end_va = 0x768aafff
monitored = 0
entry_point = 0x767fd650
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\SysWOW64\\ole32.dll" (normalized: "c:\\windows\\syswow64\\ole32.dll")
Region:
id = 1577
start_va = 0x4640000
end_va = 0x46d0fff
monitored = 0
entry_point = 0x4678cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 1578
start_va = 0x70240000
end_va = 0x702b4fff
monitored = 0
entry_point = 0x70279a60
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\SysWOW64\\uxtheme.dll" (normalized: "c:\\windows\\syswow64\\uxtheme.dll")
Region:
id = 1579
start_va = 0x4640000
end_va = 0x47bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004640000"
filename = ""
Region:
id = 1581
start_va = 0x800000
end_va = 0x80ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000800000"
filename = ""
Region:
id = 1582
start_va = 0x8c0000
end_va = 0x8cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008c0000"
filename = ""
Region:
id = 1583
start_va = 0x71600000
end_va = 0x7167dfff
monitored = 1
entry_point = 0x71601140
region_type = mapped_file
name = "clrjit.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\clrjit.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\clrjit.dll")
Region:
id = 1584
start_va = 0x76bf0000
end_va = 0x76c81fff
monitored = 0
entry_point = 0x76c28cf0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\SysWOW64\\oleaut32.dll" (normalized: "c:\\windows\\syswow64\\oleaut32.dll")
Region:
id = 1585
start_va = 0x8d0000
end_va = 0x8dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008d0000"
filename = ""
Region:
id = 1586
start_va = 0x6a400000
end_va = 0x6adabfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System\\cc4e5d110dd318e8b7d61a9ed184ab74\\System.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system\\cc4e5d110dd318e8b7d61a9ed184ab74\\system.ni.dll")
Region:
id = 1587
start_va = 0x6a270000
end_va = 0x6a3fcfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.drawing.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\System.Drawing.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.drawing\\9b645a48c9bcfc95aaadf6a069bb4ebe\\system.drawing.ni.dll")
Region:
id = 1588
start_va = 0x69610000
end_va = 0x6a268fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.windows.forms.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Windows.Forms\\8cd2187094ba6cade0ca0fab4f932654\\System.Windows.Forms.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.windows.forms\\8cd2187094ba6cade0ca0fab4f932654\\system.windows.forms.ni.dll")
Region:
id = 1589
start_va = 0x68ce0000
end_va = 0x693f1fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.core.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Core\\abad45b9cc652ba7e38c4c837234c0ab\\System.Core.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.core\\abad45b9cc652ba7e38c4c837234c0ab\\system.core.ni.dll")
Region:
id = 1590
start_va = 0x69520000
end_va = 0x6960efff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.configuration.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Configuration\\1b51e779650e38bb712f3e535efcf132\\System.Configuration.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.configuration\\1b51e779650e38bb712f3e535efcf132\\system.configuration.ni.dll")
Region:
id = 1591
start_va = 0x66960000
end_va = 0x67075fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.xml.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Xml\\1f87b5140145c221b5201351fffc52d8\\System.Xml.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.xml\\1f87b5140145c221b5201351fffc52d8\\system.xml.ni.dll")
Region:
id = 1593
start_va = 0x2170000
end_va = 0x219ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002170000"
filename = ""
Region:
id = 1594
start_va = 0x5e430000
end_va = 0x5e4cbfff
monitored = 1
entry_point = 0x5e4be9b2
region_type = mapped_file
name = "microsoft.visualbasic.dll"
filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll")
Region:
id = 1595
start_va = 0x4640000
end_va = 0x46dbfff
monitored = 1
entry_point = 0x46ce9b2
region_type = mapped_file
name = "microsoft.visualbasic.dll"
filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\Microsoft.VisualBasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\Microsoft.VisualBasic.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_msil\\microsoft.visualbasic\\v4.0_10.0.0.0__b03f5f7f11d50a3a\\microsoft.visualbasic.dll")
Region:
id = 1596
start_va = 0x47b0000
end_va = 0x47bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047b0000"
filename = ""
Region:
id = 1597
start_va = 0x47c0000
end_va = 0x48bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047c0000"
filename = ""
Region:
id = 1598
start_va = 0x8e0000
end_va = 0x8effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008e0000"
filename = ""
Region:
id = 1599
start_va = 0x2170000
end_va = 0x217ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002170000"
filename = ""
Region:
id = 1600
start_va = 0x2190000
end_va = 0x219ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002190000"
filename = ""
Region:
id = 1601
start_va = 0x8e0000
end_va = 0x8effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008e0000"
filename = ""
Region:
id = 1602
start_va = 0x2180000
end_va = 0x218ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002180000"
filename = ""
Region:
id = 1603
start_va = 0x8e0000
end_va = 0x8effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008e0000"
filename = ""
Region:
id = 1604
start_va = 0x8e0000
end_va = 0x8effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008e0000"
filename = ""
Region:
id = 1605
start_va = 0x8e0000
end_va = 0x8effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008e0000"
filename = ""
Region:
id = 1606
start_va = 0x8e0000
end_va = 0x8effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008e0000"
filename = ""
Region:
id = 1607
start_va = 0x8e0000
end_va = 0x8effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008e0000"
filename = ""
Region:
id = 1608
start_va = 0x8e0000
end_va = 0x8effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008e0000"
filename = ""
Region:
id = 1609
start_va = 0x8e0000
end_va = 0x8effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008e0000"
filename = ""
Region:
id = 1610
start_va = 0x8e0000
end_va = 0x8effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008e0000"
filename = ""
Region:
id = 1613
start_va = 0x741b0000
end_va = 0x755aefff
monitored = 0
entry_point = 0x7436b990
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\SysWOW64\\shell32.dll" (normalized: "c:\\windows\\syswow64\\shell32.dll")
Region:
id = 1614
start_va = 0x75940000
end_va = 0x75976fff
monitored = 0
entry_point = 0x75943b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\SysWOW64\\cfgmgr32.dll" (normalized: "c:\\windows\\syswow64\\cfgmgr32.dll")
Region:
id = 1615
start_va = 0x75f10000
end_va = 0x76408fff
monitored = 0
entry_point = 0x76117610
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\SysWOW64\\windows.storage.dll" (normalized: "c:\\windows\\syswow64\\windows.storage.dll")
Region:
id = 1616
start_va = 0x76cf0000
end_va = 0x76d7cfff
monitored = 0
entry_point = 0x76d39b90
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\SysWOW64\\SHCore.dll" (normalized: "c:\\windows\\syswow64\\shcore.dll")
Region:
id = 1617
start_va = 0x766e0000
end_va = 0x76723fff
monitored = 0
entry_point = 0x766e7410
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\SysWOW64\\powrprof.dll" (normalized: "c:\\windows\\syswow64\\powrprof.dll")
Region:
id = 1618
start_va = 0x77450000
end_va = 0x7745efff
monitored = 0
entry_point = 0x77452e40
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\SysWOW64\\profapi.dll" (normalized: "c:\\windows\\syswow64\\profapi.dll")
Region:
id = 1620
start_va = 0x8e0000
end_va = 0x8e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000008e0000"
filename = ""
Region:
id = 1621
start_va = 0x73e30000
end_va = 0x73e4afff
monitored = 0
entry_point = 0x73e39050
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\SysWOW64\\bcrypt.dll" (normalized: "c:\\windows\\syswow64\\bcrypt.dll")
Region:
id = 1624
start_va = 0x70040000
end_va = 0x70052fff
monitored = 0
entry_point = 0x70049950
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\SysWOW64\\cryptsp.dll" (normalized: "c:\\windows\\syswow64\\cryptsp.dll")
Region:
id = 1625
start_va = 0x70010000
end_va = 0x7003efff
monitored = 0
entry_point = 0x700295e0
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\SysWOW64\\rsaenh.dll" (normalized: "c:\\windows\\syswow64\\rsaenh.dll")
Region:
id = 1626
start_va = 0x21a0000
end_va = 0x21dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000021a0000"
filename = ""
Region:
id = 1627
start_va = 0x46e0000
end_va = 0x471ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000046e0000"
filename = ""
Region:
id = 1628
start_va = 0x4720000
end_va = 0x475ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004720000"
filename = ""
Region:
id = 1629
start_va = 0x48c0000
end_va = 0x49bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000048c0000"
filename = ""
Region:
id = 1630
start_va = 0x49c0000
end_va = 0x4abffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000049c0000"
filename = ""
Region:
id = 1631
start_va = 0x4ac0000
end_va = 0x4bbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ac0000"
filename = ""
Region:
id = 1632
start_va = 0x2180000
end_va = 0x2180fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002180000"
filename = ""
Region:
id = 1633
start_va = 0x76730000
end_va = 0x767b3fff
monitored = 0
entry_point = 0x76756220
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\SysWOW64\\clbcatq.dll" (normalized: "c:\\windows\\syswow64\\clbcatq.dll")
Region:
id = 1634
start_va = 0x21e0000
end_va = 0x21e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000021e0000"
filename = ""
Region:
id = 1635
start_va = 0x715b0000
end_va = 0x715f1fff
monitored = 1
entry_point = 0x715bf380
region_type = mapped_file
name = "wbemdisp.dll"
filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.dll")
Region:
id = 1636
start_va = 0x694b0000
end_va = 0x69516fff
monitored = 0
entry_point = 0x694cb610
region_type = mapped_file
name = "wbemcomn.dll"
filename = "\\Windows\\SysWOW64\\wbemcomn.dll" (normalized: "c:\\windows\\syswow64\\wbemcomn.dll")
Region:
id = 1637
start_va = 0x76c90000
end_va = 0x76ceefff
monitored = 0
entry_point = 0x76c94af0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\SysWOW64\\ws2_32.dll" (normalized: "c:\\windows\\syswow64\\ws2_32.dll")
Region:
id = 1638
start_va = 0x715a0000
end_va = 0x715acfff
monitored = 0
entry_point = 0x715a3520
region_type = mapped_file
name = "wbemprox.dll"
filename = "\\Windows\\SysWOW64\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemprox.dll")
Region:
id = 1639
start_va = 0x6e180000
end_va = 0x6e19bfff
monitored = 0
entry_point = 0x6e18aa90
region_type = mapped_file
name = "wmiutils.dll"
filename = "\\Windows\\SysWOW64\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wmiutils.dll")
Region:
id = 1640
start_va = 0x6e160000
end_va = 0x6e170fff
monitored = 0
entry_point = 0x6e168fa0
region_type = mapped_file
name = "wbemsvc.dll"
filename = "\\Windows\\SysWOW64\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\syswow64\\wbem\\wbemsvc.dll")
Region:
id = 1643
start_va = 0x68c20000
end_va = 0x68cdefff
monitored = 0
entry_point = 0x68c51e80
region_type = mapped_file
name = "fastprox.dll"
filename = "\\Windows\\SysWOW64\\wbem\\fastprox.dll" (normalized: "c:\\windows\\syswow64\\wbem\\fastprox.dll")
Region:
id = 1644
start_va = 0x68b90000
end_va = 0x68c10fff
monitored = 0
entry_point = 0x68bab260
region_type = mapped_file
name = "sxs.dll"
filename = "\\Windows\\SysWOW64\\sxs.dll" (normalized: "c:\\windows\\syswow64\\sxs.dll")
Region:
id = 1645
start_va = 0x4760000
end_va = 0x476efff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wbemdisp.tlb"
filename = "\\Windows\\SysWOW64\\wbem\\wbemdisp.tlb" (normalized: "c:\\windows\\syswow64\\wbem\\wbemdisp.tlb")
Region:
id = 1647
start_va = 0x4770000
end_va = 0x4771fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004770000"
filename = ""
Region:
id = 1648
start_va = 0x4780000
end_va = 0x4780fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004780000"
filename = ""
Region:
id = 1649
start_va = 0x4bc0000
end_va = 0x4c9ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\SysWOW64\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\syswow64\\en-us\\kernelbase.dll.mui")
Region:
id = 1650
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1651
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1652
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1653
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1654
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1655
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1656
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1657
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1658
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1660
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1661
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1662
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1663
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1664
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1665
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1666
start_va = 0x47a0000
end_va = 0x47affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047a0000"
filename = ""
Region:
id = 1667
start_va = 0x47a0000
end_va = 0x47affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047a0000"
filename = ""
Region:
id = 1668
start_va = 0x47a0000
end_va = 0x47affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000047a0000"
filename = ""
Region:
id = 1670
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1671
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1672
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1673
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1674
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1675
start_va = 0x4790000
end_va = 0x479ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004790000"
filename = ""
Region:
id = 1774
start_va = 0x69440000
end_va = 0x69457fff
monitored = 1
entry_point = 0x69445480
region_type = mapped_file
name = "custommarshalers.dll"
filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll")
Region:
id = 1775
start_va = 0x4790000
end_va = 0x47a7fff
monitored = 1
entry_point = 0x4795480
region_type = mapped_file
name = "custommarshalers.dll"
filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll")
Region:
id = 1776
start_va = 0x4ca0000
end_va = 0x4caffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ca0000"
filename = ""
Region:
id = 1777
start_va = 0x69440000
end_va = 0x69457fff
monitored = 1
entry_point = 0x69445480
region_type = mapped_file
name = "custommarshalers.dll"
filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll")
Region:
id = 1778
start_va = 0x4cb0000
end_va = 0x4cc7fff
monitored = 1
entry_point = 0x4cb5480
region_type = mapped_file
name = "custommarshalers.dll"
filename = "\\Windows\\Microsoft.NET\\assembly\\GAC_32\\CustomMarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\CustomMarshalers.dll" (normalized: "c:\\windows\\microsoft.net\\assembly\\gac_32\\custommarshalers\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\custommarshalers.dll")
Region:
id = 1779
start_va = 0x4cb0000
end_va = 0x4cbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cb0000"
filename = ""
Region:
id = 1780
start_va = 0x4cc0000
end_va = 0x4ccffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cc0000"
filename = ""
Region:
id = 1781
start_va = 0x4cc0000
end_va = 0x4ccffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cc0000"
filename = ""
Region:
id = 1783
start_va = 0x4cc0000
end_va = 0x4ccffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cc0000"
filename = ""
Region:
id = 1786
start_va = 0x4cc0000
end_va = 0x4cc4fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "stdole2.tlb"
filename = "\\Windows\\SysWOW64\\stdole2.tlb" (normalized: "c:\\windows\\syswow64\\stdole2.tlb")
Region:
id = 1787
start_va = 0x4cd0000
end_va = 0x4cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cd0000"
filename = ""
Region:
id = 1788
start_va = 0x4cd0000
end_va = 0x4cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cd0000"
filename = ""
Region:
id = 1789
start_va = 0x4cd0000
end_va = 0x4cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cd0000"
filename = ""
Region:
id = 1790
start_va = 0x4cd0000
end_va = 0x4cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cd0000"
filename = ""
Region:
id = 1791
start_va = 0x4cd0000
end_va = 0x4cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cd0000"
filename = ""
Region:
id = 1792
start_va = 0x4cd0000
end_va = 0x4cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cd0000"
filename = ""
Region:
id = 1793
start_va = 0x4cd0000
end_va = 0x4cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cd0000"
filename = ""
Region:
id = 1794
start_va = 0x4cd0000
end_va = 0x4cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cd0000"
filename = ""
Region:
id = 1795
start_va = 0x4cd0000
end_va = 0x4cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cd0000"
filename = ""
Region:
id = 1796
start_va = 0x4cd0000
end_va = 0x4cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cd0000"
filename = ""
Region:
id = 1797
start_va = 0x4cd0000
end_va = 0x4cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cd0000"
filename = ""
Region:
id = 1798
start_va = 0x4cd0000
end_va = 0x4cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cd0000"
filename = ""
Region:
id = 1799
start_va = 0x4ce0000
end_va = 0x4ceffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ce0000"
filename = ""
Region:
id = 1800
start_va = 0x4ce0000
end_va = 0x4ceffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ce0000"
filename = ""
Region:
id = 1801
start_va = 0x4ce0000
end_va = 0x4ceffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ce0000"
filename = ""
Region:
id = 1804
start_va = 0x66840000
end_va = 0x6695bfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "system.management.ni.dll"
filename = "\\Windows\\assembly\\NativeImages_v4.0.30319_32\\System.Management\\d2f554a0c84513cd793fdcd77a86dab1\\System.Management.ni.dll" (normalized: "c:\\windows\\assembly\\nativeimages_v4.0.30319_32\\system.management\\d2f554a0c84513cd793fdcd77a86dab1\\system.management.ni.dll")
Region:
id = 1805
start_va = 0x4cd0000
end_va = 0x4d0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004cd0000"
filename = ""
Region:
id = 1806
start_va = 0x4d10000
end_va = 0x4e0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004d10000"
filename = ""
Region:
id = 1807
start_va = 0x7fe60000
end_va = 0x7feaffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fe60000"
filename = ""
Region:
id = 1808
start_va = 0x7fe50000
end_va = 0x7fe5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007fe50000"
filename = ""
Region:
id = 1810
start_va = 0x4e10000
end_va = 0x4e4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004e10000"
filename = ""
Region:
id = 1811
start_va = 0x4e50000
end_va = 0x4f4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004e50000"
filename = ""
Region:
id = 1812
start_va = 0x69430000
end_va = 0x69439fff
monitored = 1
entry_point = 0x694339f9
region_type = mapped_file
name = "wminet_utils.dll"
filename = "\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WMINet_Utils.dll" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\wminet_utils.dll")
Region:
id = 1815
start_va = 0x4f50000
end_va = 0x4f5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004f50000"
filename = ""
Region:
id = 1816
start_va = 0x4f50000
end_va = 0x4f5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004f50000"
filename = ""
Region:
id = 1817
start_va = 0x4f50000
end_va = 0x4f5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004f50000"
filename = ""
Region:
id = 1823
start_va = 0x4f50000
end_va = 0x4f54fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004f50000"
filename = ""
Thread:
id = 111
os_tid = 0x704
[0226.725] CoInitializeEx (pvReserved=0x0, dwCoInit=0x2) returned 0x0
[0226.858] RoInitialize () returned 0x1
[0226.858] RoUninitialize () returned 0x0
[0227.577] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x248
[0227.577] CreateEventW (lpEventAttributes=0x0, bManualReset=1, bInitialState=0, lpName=0x0) returned 0x24c
[0227.598] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows NT\\CurrentVersion", ulOptions=0x0, samDesired=0x20019, phkResult=0x19e60c | out: phkResult=0x19e60c*=0x25c) returned 0x0
[0227.599] RegQueryValueExW (in: hKey=0x25c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19e62c, lpData=0x0, lpcbData=0x19e628*=0x0 | out: lpType=0x19e62c*=0x1, lpData=0x0, lpcbData=0x19e628*=0xe) returned 0x0
[0227.635] RegQueryValueExW (in: hKey=0x25c, lpValueName="InstallationType", lpReserved=0x0, lpType=0x19e62c, lpData=0x2204858, lpcbData=0x19e628*=0xe | out: lpType=0x19e62c*=0x1, lpData="Client", lpcbData=0x19e628*=0xe) returned 0x0
[0227.636] RegCloseKey (hKey=0x25c) returned 0x0
[0227.938] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe.config", nBufferLength=0x105, lpBuffer=0x19dfc8, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe.config", lpFilePart=0x0) returned 0x69
[0227.940] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe.config", nBufferLength=0x105, lpBuffer=0x19df70, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe.config", lpFilePart=0x0) returned 0x69
[0228.558] GetCurrentProcess () returned 0xffffffff
[0228.558] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e328 | out: TokenHandle=0x19e328*=0x25c) returned 1
[0228.561] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x19de04, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e
[0228.563] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1
[0228.564] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43
[0228.565] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1
[0228.566] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", nBufferLength=0x105, lpBuffer=0x19dd60, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config", lpFilePart=0x0) returned 0x43
[0228.567] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19e254) returned 1
[0228.567] CreateFileW (lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\Config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x100000, hTemplateFile=0x0) returned 0x260
[0228.567] GetFileType (hFile=0x260) returned 0x1
[0228.567] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19e250) returned 1
[0228.567] GetFileType (hFile=0x260) returned 0x1
[0228.593] GetFileSize (in: hFile=0x260, lpFileSizeHigh=0x19e31c | out: lpFileSizeHigh=0x19e31c*=0x0) returned 0x8c8f
[0228.593] ReadFile (in: hFile=0x260, lpBuffer=0x2208650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e2d8, lpOverlapped=0x0 | out: lpBuffer=0x2208650*, lpNumberOfBytesRead=0x19e2d8*=0x1000, lpOverlapped=0x0) returned 1
[0228.639] ReadFile (in: hFile=0x260, lpBuffer=0x2208650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e174, lpOverlapped=0x0 | out: lpBuffer=0x2208650*, lpNumberOfBytesRead=0x19e174*=0x1000, lpOverlapped=0x0) returned 1
[0228.648] ReadFile (in: hFile=0x260, lpBuffer=0x2208650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e028, lpOverlapped=0x0 | out: lpBuffer=0x2208650*, lpNumberOfBytesRead=0x19e028*=0x1000, lpOverlapped=0x0) returned 1
[0228.649] ReadFile (in: hFile=0x260, lpBuffer=0x2208650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e028, lpOverlapped=0x0 | out: lpBuffer=0x2208650*, lpNumberOfBytesRead=0x19e028*=0x1000, lpOverlapped=0x0) returned 1
[0228.650] ReadFile (in: hFile=0x260, lpBuffer=0x2208650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e028, lpOverlapped=0x0 | out: lpBuffer=0x2208650*, lpNumberOfBytesRead=0x19e028*=0x1000, lpOverlapped=0x0) returned 1
[0228.650] ReadFile (in: hFile=0x260, lpBuffer=0x2208650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19df60, lpOverlapped=0x0 | out: lpBuffer=0x2208650*, lpNumberOfBytesRead=0x19df60*=0x1000, lpOverlapped=0x0) returned 1
[0228.656] ReadFile (in: hFile=0x260, lpBuffer=0x2208650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e0dc, lpOverlapped=0x0 | out: lpBuffer=0x2208650*, lpNumberOfBytesRead=0x19e0dc*=0x1000, lpOverlapped=0x0) returned 1
[0228.657] ReadFile (in: hFile=0x260, lpBuffer=0x2208650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19dff0, lpOverlapped=0x0 | out: lpBuffer=0x2208650*, lpNumberOfBytesRead=0x19dff0*=0x1000, lpOverlapped=0x0) returned 1
[0228.657] ReadFile (in: hFile=0x260, lpBuffer=0x2208650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19dff0, lpOverlapped=0x0 | out: lpBuffer=0x2208650*, lpNumberOfBytesRead=0x19dff0*=0xc8f, lpOverlapped=0x0) returned 1
[0228.657] ReadFile (in: hFile=0x260, lpBuffer=0x2208650, nNumberOfBytesToRead=0x1000, lpNumberOfBytesRead=0x19e0b0, lpOverlapped=0x0 | out: lpBuffer=0x2208650*, lpNumberOfBytesRead=0x19e0b0*=0x0, lpOverlapped=0x0) returned 1
[0228.658] CloseHandle (hObject=0x260) returned 1
[0228.659] GetCurrentProcess () returned 0xffffffff
[0228.659] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x260) returned 1
[0228.659] GetCurrentProcess () returned 0xffffffff
[0228.659] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x264) returned 1
[0228.660] GetCurrentProcess () returned 0xffffffff
[0228.660] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e328 | out: TokenHandle=0x19e328*=0x268) returned 1
[0228.660] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0228.660] GetFullPathNameW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe.config", nBufferLength=0x105, lpBuffer=0x19ddd0, lpFilePart=0x0 | out: lpBuffer="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe.config", lpFilePart=0x0) returned 0x69
[0228.661] GetFileAttributesExW (in: lpFileName="C:\\Users\\RDhJ0CNFevzX\\Desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe.config" (normalized: "c:\\users\\rdhj0cnfevzx\\desktop\\7bb212946fdeb406c7aa8f691405d185065514d5dc1f269f8e409762ff9f6915.exe.config"), fInfoLevelId=0x0, lpFileInformation=0x19e328 | out: lpFileInformation=0x19e328*(dwFileAttributes=0x0, ftCreationTime.dwLowDateTime=0x0, ftCreationTime.dwHighDateTime=0x0, ftLastAccessTime.dwLowDateTime=0x0, ftLastAccessTime.dwHighDateTime=0x0, ftLastWriteTime.dwLowDateTime=0x0, ftLastWriteTime.dwHighDateTime=0x0, nFileSizeHigh=0x0, nFileSizeLow=0x0)) returned 0
[0228.661] GetCurrentProcess () returned 0xffffffff
[0228.661] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x26c) returned 1
[0228.661] GetCurrentProcess () returned 0xffffffff
[0228.662] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e450 | out: TokenHandle=0x19e450*=0x270) returned 1
[0228.707] GetCurrentProcess () returned 0xffffffff
[0228.707] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e214 | out: TokenHandle=0x19e214*=0x274) returned 1
[0228.725] GetCurrentProcess () returned 0xffffffff
[0228.725] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x2000000, TokenHandle=0x19e228 | out: TokenHandle=0x19e228*=0x278) returned 1
[0228.775] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\AppContext", ulOptions=0x0, samDesired=0x20019, phkResult=0x19def0 | out: phkResult=0x19def0*=0x0) returned 0x2
[0228.778] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="SOFTWARE\\Microsoft\\.NETFramework\\v4.0.30319", ulOptions=0x0, samDesired=0x20019, phkResult=0x19f408 | out: phkResult=0x19f408*=0x27c) returned 0x0
[0228.778] RegQueryValueExW (in: hKey=0x27c, lpValueName="SchUseStrongCrypto", lpReserved=0x0, lpType=0x19f424, lpData=0x0, lpcbData=0x19f420*=0x0 | out: lpType=0x19f424*=0x0, lpData=0x0, lpcbData=0x19f420*=0x0) returned 0x2
[0228.779] RegCloseKey (hKey=0x27c) returned 0x0
[0228.848] GetCurrentProcessId () returned 0x13ac
[0228.849] LookupPrivilegeValueW (in: lpSystemName=0x0, lpName="SeDebugPrivilege", lpLuid=0x19ed74 | out: lpLuid=0x19ed74*(LowPart=0x14, HighPart=0)) returned 1
[0228.850] GetCurrentProcess () returned 0xffffffff
[0228.850] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x20, TokenHandle=0x19ed70 | out: TokenHandle=0x19ed70*=0x28c) returned 1
[0228.850] AdjustTokenPrivileges (in: TokenHandle=0x28c, DisableAllPrivileges=0, NewState=0x2225020*(PrivilegesCount=0x1, Privileges=((Luid.LowPart=0x14, Luid.HighPart=0, Attributes=0x2))), BufferLength=0x0, PreviousState=0x0, ReturnLength=0x0 | out: PreviousState=0x0, ReturnLength=0x0) returned 1
[0228.851] CloseHandle (hObject=0x28c) returned 1
[0228.859] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x32094b0, Length=0x20000, ResultLength=0x19f454 | out: SystemInformation=0x32094b0, ResultLength=0x19f454*=0x17828) returned 0x0
[0228.877] GetCurrentProcessId () returned 0x13ac
[0228.928] NtQuerySystemInformation (in: SystemInformationClass=0x5, SystemInformation=0x32094b0, Length=0x20000, ResultLength=0x19f444 | out: SystemInformation=0x32094b0, ResultLength=0x19f444*=0x17828) returned 0x0
[0229.236] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ee2c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43
[0229.236] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", nBufferLength=0x105, lpBuffer=0x19ee94, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config", lpFilePart=0x0) returned 0x43
[0229.236] SetThreadErrorMode (dwNewMode=0x1, lpOldMode=0x19f2f4) returned 1
[0229.236] GetFileAttributesExW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\config\\machine.config" (normalized: "c:\\windows\\microsoft.net\\framework\\v4.0.30319\\config\\machine.config"), fInfoLevelId=0x0, lpFileInformation=0x19f370 | out: lpFileInformation=0x19f370*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x56a29ff, ftCreationTime.dwHighDateTime=0x1d112e4, ftLastAccessTime.dwLowDateTime=0x97df7583, ftLastAccessTime.dwHighDateTime=0x1d112e3, ftLastWriteTime.dwLowDateTime=0x97df7583, ftLastWriteTime.dwHighDateTime=0x1d112e3, nFileSizeHigh=0x0, nFileSizeLow=0x8c8f)) returned 1
[0229.236] SetThreadErrorMode (dwNewMode=0x0, lpOldMode=0x19f2f0) returned 1
[0229.376] BCryptGetFipsAlgorithmMode (in: pfEnabled=0x19f07c | out: pfEnabled=0x19f07c) returned 0x0
[0229.467] CreateBindCtx (in: reserved=0x0, ppbc=0x19f420 | out: ppbc=0x19f420*=0x500fa8) returned 0x0
[0229.468] IUnknown:QueryInterface (in: This=0x500fa8, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eedc | out: ppvObject=0x19eedc*=0x500fa8) returned 0x0
[0229.468] IUnknown:QueryInterface (in: This=0x500fa8, riid=0x6c12fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee98 | out: ppvObject=0x19ee98*=0x0) returned 0x80004002
[0229.468] IUnknown:QueryInterface (in: This=0x500fa8, riid=0x6c12fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ecb4 | out: ppvObject=0x19ecb4*=0x0) returned 0x80004002
[0229.468] IUnknown:QueryInterface (in: This=0x500fa8, riid=0x6c13056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea8c | out: ppvObject=0x19ea8c*=0x0) returned 0x80004002
[0229.468] IUnknown:AddRef (This=0x500fa8) returned 0x3
[0229.468] IUnknown:QueryInterface (in: This=0x500fa8, riid=0x6c130208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7f4 | out: ppvObject=0x19e7f4*=0x0) returned 0x80004002
[0229.468] IUnknown:QueryInterface (in: This=0x500fa8, riid=0x6c13015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e7a4 | out: ppvObject=0x19e7a4*=0x0) returned 0x80004002
[0229.468] IUnknown:QueryInterface (in: This=0x500fa8, riid=0x6c0040e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e7b0 | out: ppvObject=0x19e7b0*=0x0) returned 0x80004002
[0229.469] CoGetContextToken (in: pToken=0x19e810 | out: pToken=0x19e810) returned 0x0
[0229.469] CObjectContext::QueryInterface () returned 0x0
[0229.469] CObjectContext::GetCurrentApartmentType () returned 0x0
[0229.469] Release () returned 0x0
[0229.469] CoGetObjectContext (in: riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x50aeb4 | out: ppv=0x50aeb4*=0x4f0070) returned 0x0
[0229.525] CoGetContextToken (in: pToken=0x19ec18 | out: pToken=0x19ec18) returned 0x0
[0229.525] IUnknown:QueryInterface (in: This=0x500fa8, riid=0x6c130448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eca8 | out: ppvObject=0x19eca8*=0x0) returned 0x80004002
[0229.525] IUnknown:Release (This=0x500fa8) returned 0x2
[0229.525] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0
[0229.527] CoGetContextToken (in: pToken=0x19f150 | out: pToken=0x19f150) returned 0x0
[0229.527] IUnknown:QueryInterface (in: This=0x500fa8, riid=0x19f220*(Data1=0xe, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f21c | out: ppvObject=0x19f21c*=0x500fa8) returned 0x0
[0229.528] IUnknown:AddRef (This=0x500fa8) returned 0x4
[0229.528] IUnknown:Release (This=0x500fa8) returned 0x3
[0229.528] IUnknown:Release (This=0x500fa8) returned 0x2
[0229.528] CoGetContextToken (in: pToken=0x19f268 | out: pToken=0x19f268) returned 0x0
[0229.528] IUnknown:AddRef (This=0x500fa8) returned 0x3
[0229.529] MkParseDisplayName (in: pbc=0x500fa8, szUserName="WinMgmts:", pchEaten=0x19f454, ppmk=0x19f40c | out: pchEaten=0x19f454, ppmk=0x19f40c*=0x51f0c0) returned 0x0
[0230.606] malloc (_Size=0x80) returned 0x8f2c60
[0230.607] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x51eb80
[0230.607] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0230.608] DllGetClassObject (in: rclsid=0x5289dc*(Data1=0x172bddf8, Data2=0xceea, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x5, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), riid=0x769c7590*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f1f8 | out: ppv=0x19f1f8*=0x51eac0) returned 0x0
[0230.608] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x51eac0
[0230.608] WinMGMTS:IClassFactory:CreateInstance (in: This=0x51eac0, pUnkOuter=0x0, riid=0x767c6800*(Data1=0x11a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1a0 | out: ppvObject=0x19f1a0*=0x51e4d0) returned 0x0
[0230.610] GetVersionExW (in: lpVersionInformation=0x19ef58*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x19efb8, dwMinorVersion=0x7642234f, dwBuildNumber=0xc0150008, dwPlatformId=0x0, szCSDVersion="\≶) | out: lpVersionInformation=0x19ef58*(dwOSVersionInfoSize=0x114, dwMajorVersion=0x6, dwMinorVersion=0x2, dwBuildNumber=0x23f0, dwPlatformId=0x2, szCSDVersion="")) returned 1
[0230.610] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x19ef50 | out: phkResult=0x19ef50*=0x37c) returned 0x0
[0230.610] RegQueryValueExW (in: hKey=0x37c, lpValueName="Default Impersonation Level", lpReserved=0x0, lpType=0x0, lpData=0x19ef48, lpcbData=0x19ef54*=0x4 | out: lpType=0x0, lpData=0x19ef48*=0x3, lpcbData=0x19ef54*=0x4) returned 0x0
[0230.610] RegCloseKey (hKey=0x37c) returned 0x0
[0230.610] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52a350
[0230.610] GetSystemDirectoryW (in: lpBuffer=0x52a350, uSize=0x104 | out: lpBuffer="C:\\Windows\\system32") returned 0x13
[0230.610] LoadLibraryExW (lpLibFileName="C:\\Windows\\system32\\advapi32.dll", hFile=0x0, dwFlags=0x0) returned 0x76b70000
[0230.611] GetProcAddress (hModule=0x76b70000, lpProcName="DuplicateTokenEx") returned 0x76b90ad0
[0230.611] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0230.611] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x51f250
[0230.611] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x51e4d0
[0230.611] WinMGMTS:IUnknown:Release (This=0x51eac0) returned 0x0
[0230.611] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0230.611] WinMGMTS:IParseDisplayName:ParseDisplayName (in: This=0x51e4d0, pbc=0x500fa8, pszDisplayName="WinMgmts:", pchEaten=0x19f3b0, ppmkOut=0x19f3ac | out: pchEaten=0x19f3b0*=0x9, ppmkOut=0x19f3ac*=0x51f0c0) returned 0x0
[0230.611] ApiSetQueryApiSetPresence () returned 0x0
[0230.611] _wcsnicmp (_String1="WinMgmts:", _String2="WINMGMTS:", _MaxCount=0x9) returned 0
[0230.612] IBindCtx:GetObjectParam (in: This=0x500fa8, pszKey=0x715b3e5c, ppunk=0x19f258 | out: ppunk=0x19f258*=0x0) returned 0x80004005
[0230.612] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4c50c0
[0230.612] _wcsnicmp (_String1="", _String2="{", _MaxCount=0x1) returned -123
[0230.612] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x506f30
[0230.612] ResolveDelayLoadedAPI () returned 0x76a30060
[0230.612] CoCreateInstance (in: rclsid=0x715b1c58*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x715b1c48*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x506f48 | out: ppv=0x506f48*=0x51e4e0) returned 0x0
[0230.809] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5072d8
[0230.809] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x502478
[0230.809] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4c4e80
[0230.809] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0230.809] GetCurrentThreadId () returned 0x704
[0230.809] _wcsnicmp (_String1="", _String2="[", _MaxCount=0x1) returned -91
[0230.809] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0230.809] GetCurrentThreadId () returned 0x704
[0230.811] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Wbem\\Scripting", ulOptions=0x0, samDesired=0x1, phkResult=0x19f0cc | out: phkResult=0x19f0cc*=0x388) returned 0x0
[0230.811] RegQueryValueExW (in: hKey=0x388, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x0, lpcbData=0x19f0d0*=0x0 | out: lpType=0x0, lpData=0x0, lpcbData=0x19f0d0*=0x16) returned 0x0
[0230.811] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4c4de0
[0230.811] RegQueryValueExW (in: hKey=0x388, lpValueName="Default Namespace", lpReserved=0x0, lpType=0x0, lpData=0x4c4de0, lpcbData=0x19f0d0*=0x16 | out: lpType=0x0, lpData=0x4c4de0*=0x72, lpcbData=0x19f0d0*=0x16) returned 0x0
[0230.811] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4c4ee0
[0230.812] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0230.812] RegCloseKey (hKey=0x388) returned 0x0
[0230.813] CoCreateInstance (in: rclsid=0x715b21a8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x715b21b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f104 | out: ppv=0x19f104*=0x506e98) returned 0x0
[0231.013] SysStringLen (param_1=".") returned 0x1
[0231.013] WbemDefPath:IWbemPath:SetServer (This=0x506e98, Name=".") returned 0x0
[0231.023] CoCreateInstance (in: rclsid=0x715b21a8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x715b21b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f0b0 | out: ppv=0x19f0b0*=0x4ff948) returned 0x0
[0231.023] CoCreateInstance (in: rclsid=0x715b21a8*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x715b21b8*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppv=0x19f04c | out: ppv=0x19f04c*=0x52ae48) returned 0x0
[0231.023] WbemDefPath:IWbemPath:SetText (This=0x52ae48, uMode=0x4, pszPath="root\\cimv2") returned 0x0
[0231.023] WbemDefPath:IUnknown:Release (This=0x52ae48) returned 0x0
[0231.023] SysStringLen (param_1="root\\cimv2") returned 0xa
[0231.023] WbemDefPath:IWbemPath:SetText (This=0x4ff948, uMode=0xc, pszPath="root\\cimv2") returned 0x0
[0231.023] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x4ff948, puCount=0x19f0c8 | out: puCount=0x19f0c8*=0x2) returned 0x0
[0231.023] WbemDefPath:IWbemPath:RemoveAllNamespaces (This=0x506e98) returned 0x0
[0231.023] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4ff948, uIndex=0x0, puNameBufLength=0x19f084*=0x0, pName=0x0 | out: puNameBufLength=0x19f084*=0x5, pName=0x0) returned 0x0
[0231.023] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x51ec88
[0231.023] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4ff948, uIndex=0x0, puNameBufLength=0x19f084*=0x5, pName="cimv2" | out: puNameBufLength=0x19f084*=0x5, pName="root") returned 0x0
[0231.023] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0231.023] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x506e98, uIndex=0x0, pszName="root") returned 0x0
[0231.023] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4ff948, uIndex=0x1, puNameBufLength=0x19f084*=0x0, pName=0x0 | out: puNameBufLength=0x19f084*=0x6, pName=0x0) returned 0x0
[0231.023] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x51ec40
[0231.024] WbemDefPath:IWbemPath:GetNamespaceAt (in: This=0x4ff948, uIndex=0x1, puNameBufLength=0x19f084*=0x6, pName="䅬皝䆐皝O" | out: puNameBufLength=0x19f084*=0x6, pName="cimv2") returned 0x0
[0231.024] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0231.024] WbemDefPath:IWbemPath:SetNamespaceAt (This=0x506e98, uIndex=0x1, pszName="cimv2") returned 0x0
[0231.024] WbemDefPath:IUnknown:Release (This=0x4ff948) returned 0x0
[0231.024] WbemDefPath:IWbemPath:GetText (in: This=0x506e98, lFlags=4, puBuffLength=0x19f0cc*=0x0, pszText=0x0 | out: puBuffLength=0x19f0cc*=0xf, pszText=0x0) returned 0x0
[0231.024] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x51f318
[0231.024] WbemDefPath:IWbemPath:GetText (in: This=0x506e98, lFlags=4, puBuffLength=0x19f0cc*=0xf, pszText="cimv2" | out: puBuffLength=0x19f0cc*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
[0231.024] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0231.024] WbemDefPath:IUnknown:Release (This=0x506e98) returned 0x0
[0231.024] WbemLocator:IWbemLocator:ConnectServer (in: This=0x51e4e0, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale=0x0, lSecurityFlags=0, strAuthority=0x0, pCtx=0x0, ppNamespace=0x19f14c | out: ppNamespace=0x19f14c*=0x4e2858) returned 0x0
[0231.952] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52c6a0
[0231.952] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5025f8
[0231.952] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x520c08
[0231.952] WbemLocator:IUnknown:QueryInterface (in: This=0x4e2858, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f13c | out: ppvObject=0x19f13c*=0x517ccc) returned 0x0
[0231.953] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x517ccc, pProxy=0x4e2858, pAuthnSvc=0x19f118, pAuthzSvc=0x19f11c, pServerPrincName=0x0, pAuthnLevel=0x19f18c, pImpLevel=0x19f194, pAuthInfo=0x0, pCapabilites=0x19f120 | out: pAuthnSvc=0x19f118*=0xa, pAuthzSvc=0x19f11c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19f18c*=0x6, pImpLevel=0x19f194*=0x2, pAuthInfo=0x0, pCapabilites=0x19f120*=0x1) returned 0x0
[0231.953] WbemLocator:IUnknown:Release (This=0x517ccc) returned 0x1
[0231.957] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0231.957] GetCurrentThreadId () returned 0x704
[0231.957] WbemLocator:IUnknown:QueryInterface (in: This=0x4e2858, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1b4 | out: ppvObject=0x19f1b4*=0x517ccc) returned 0x0
[0231.960] WbemLocator:IClientSecurity:CopyProxy (in: This=0x517ccc, pProxy=0x4e2858, ppCopy=0x19f1d8 | out: ppCopy=0x19f1d8*=0x52ed18) returned 0x0
[0231.960] WbemLocator:IUnknown:QueryInterface (in: This=0x52ed18, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f050 | out: ppvObject=0x19f050*=0x517ccc) returned 0x0
[0231.964] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x517ccc, pProxy=0x52ed18, pAuthnSvc=0x19f080, pAuthzSvc=0x19f07c, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x19f080*=0xa, pAuthzSvc=0x19f07c*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0
[0231.964] WbemLocator:IUnknown:Release (This=0x517ccc) returned 0x3
[0231.964] WbemLocator:IUnknown:QueryInterface (in: This=0x52ed18, riid=0x715b1f08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f034 | out: ppvObject=0x19f034*=0x517cf0) returned 0x0
[0231.967] WbemLocator:IUnknown:QueryInterface (in: This=0x52ed18, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f038 | out: ppvObject=0x19f038*=0x517ccc) returned 0x0
[0231.968] WbemLocator:IClientSecurity:SetBlanket (This=0x517ccc, pProxy=0x52ed18, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
[0231.971] WbemLocator:IUnknown:Release (This=0x517ccc) returned 0x4
[0231.971] WbemLocator:IUnknown:Release (This=0x517cf0) returned 0x3
[0231.971] WbemLocator:IUnknown:Release (This=0x517ccc) returned 0x2
[0231.971] WbemLocator:IUnknown:AddRef (This=0x52ed18) returned 0x3
[0231.971] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x502238
[0231.971] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52aef0
[0231.972] WbemLocator:IUnknown:Release (This=0x4e2858) returned 0x2
[0231.972] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0231.972] GetCurrentThreadId () returned 0x704
[0231.972] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0231.972] GetCurrentThreadId () returned 0x704
[0231.972] WbemLocator:IUnknown:QueryInterface (in: This=0x52ed18, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f1dc | out: ppvObject=0x19f1dc*=0x517ccc) returned 0x0
[0231.972] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x517ccc, pProxy=0x52ed18, pAuthnSvc=0x19f1c8, pAuthzSvc=0x19f1cc, pServerPrincName=0x0, pAuthnLevel=0x19f1d8, pImpLevel=0x19f1d4, pAuthInfo=0x0, pCapabilites=0x19f1d0 | out: pAuthnSvc=0x19f1c8*=0xa, pAuthzSvc=0x19f1cc*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19f1d8*=0x6, pImpLevel=0x19f1d4*=0x3, pAuthInfo=0x0, pCapabilites=0x19f1d0*=0x20) returned 0x0
[0231.972] WbemLocator:IUnknown:Release (This=0x517ccc) returned 0x2
[0231.972] ResolveDelayLoadedAPI () returned 0x767f2060
[0231.973] CreatePointerMoniker (in: punk=0x52c6a0, ppmk=0x19f3ac | out: ppmk=0x19f3ac*=0x51f0c0) returned 0x0
[0231.973] IUnknown:AddRef (This=0x52c6a0) returned 0x2
[0231.977] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0231.978] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0231.978] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0231.978] WbemLocator:IUnknown:Release (This=0x51e4e0) returned 0x0
[0231.979] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0231.979] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0231.984] WinMGMTS:IUnknown:Release (This=0x51e4d0) returned 0x0
[0231.984] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0232.001] IUnknown:QueryInterface (in: This=0x51f0c0, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eed0 | out: ppvObject=0x19eed0*=0x51f0c0) returned 0x0
[0232.001] IUnknown:QueryInterface (in: This=0x51f0c0, riid=0x6c12fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee8c | out: ppvObject=0x19ee8c*=0x0) returned 0x80004002
[0232.001] IUnknown:QueryInterface (in: This=0x51f0c0, riid=0x6c12fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ecac | out: ppvObject=0x19ecac*=0x0) returned 0x80004002
[0232.001] IUnknown:QueryInterface (in: This=0x51f0c0, riid=0x6c13056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea84 | out: ppvObject=0x19ea84*=0x0) returned 0x80004002
[0232.002] IUnknown:AddRef (This=0x51f0c0) returned 0x3
[0232.002] IUnknown:QueryInterface (in: This=0x51f0c0, riid=0x6c130208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ec | out: ppvObject=0x19e7ec*=0x0) returned 0x80004002
[0232.002] IUnknown:QueryInterface (in: This=0x51f0c0, riid=0x6c13015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e79c | out: ppvObject=0x19e79c*=0x0) returned 0x80004002
[0232.002] IUnknown:QueryInterface (in: This=0x51f0c0, riid=0x6c0040e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e7a8 | out: ppvObject=0x19e7a8*=0x51f0d4) returned 0x0
[0232.002] IMarshal:GetUnmarshalClass (in: This=0x51f0d4, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e7b0 | out: pCid=0x19e7b0*(Data1=0x306, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
[0232.002] IUnknown:Release (This=0x51f0d4) returned 0x3
[0232.002] CoGetContextToken (in: pToken=0x19e808 | out: pToken=0x19e808) returned 0x0
[0232.002] CoGetContextToken (in: pToken=0x19ec10 | out: pToken=0x19ec10) returned 0x0
[0232.002] IUnknown:QueryInterface (in: This=0x51f0c0, riid=0x6c130448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eca0 | out: ppvObject=0x19eca0*=0x0) returned 0x80004002
[0232.002] IUnknown:Release (This=0x51f0c0) returned 0x2
[0232.002] CoGetContextToken (in: pToken=0x19f1e0 | out: pToken=0x19f1e0) returned 0x0
[0232.002] CoGetContextToken (in: pToken=0x19f140 | out: pToken=0x19f140) returned 0x0
[0232.002] IUnknown:QueryInterface (in: This=0x51f0c0, riid=0x19f210*(Data1=0xf, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f20c | out: ppvObject=0x19f20c*=0x51f0c0) returned 0x0
[0232.002] IUnknown:AddRef (This=0x51f0c0) returned 0x4
[0232.002] IUnknown:Release (This=0x51f0c0) returned 0x3
[0232.002] IUnknown:Release (This=0x500fa8) returned 0x2
[0232.002] IUnknown:Release (This=0x51f0c0) returned 0x2
[0232.005] CoGetContextToken (in: pToken=0x19f270 | out: pToken=0x19f270) returned 0x0
[0232.005] IUnknown:AddRef (This=0x51f0c0) returned 0x3
[0232.005] BindMoniker (in: pmk=0x51f0c0, grfOpt=0x0, iidResult=0x229f510*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvResult=0x19f410 | out: ppvResult=0x19f410*=0x52c6a0) returned 0x0
[0232.005] IUnknown:QueryInterface (in: This=0x52c6a0, riid=0x229f510*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f410 | out: ppvObject=0x19f410*=0x52c6a0) returned 0x0
[0232.006] LoadRegTypeLib (in: rguid=0x715b2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x19ec6c*=0x0 | out: pptlib=0x19ec6c*=0x532490) returned 0x0
[0232.255] ITypeLib:GetTypeInfoOfGuid (in: This=0x532490, GUID=0x52c6e4*(Data1=0x62e522dc, Data2=0x8cf3, Data3=0x40a8, Data4=([0]=0x8b, [1]=0x2e, [2]=0x37, [3]=0xd5, [4]=0x95, [5]=0x65, [6]=0x1e, [7]=0x40)), ppTInfo=0x52c6cc | out: ppTInfo=0x52c6cc*=0x533ee4) returned 0x0
[0232.257] IUnknown:Release (This=0x532490) returned 0x1
[0232.307] CoGetContextToken (in: pToken=0x19e808 | out: pToken=0x19e808) returned 0x0
[0232.307] CoGetContextToken (in: pToken=0x19ec10 | out: pToken=0x19ec10) returned 0x0
[0232.307] IUnknown:Release (This=0x51f0c0) returned 0x2
[0232.642] CoGetContextToken (in: pToken=0x19eef0 | out: pToken=0x19eef0) returned 0x0
[0232.642] LoadRegTypeLib (in: rguid=0x715b2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x19eed8*=0x0 | out: pptlib=0x19eed8*=0x532490) returned 0x0
[0232.644] ITypeLib:GetTypeInfoOfGuid (in: This=0x532490, GUID=0x52c6d4*(Data1=0xd2f68443, Data2=0x85dc, Data3=0x427e, Data4=([0]=0x91, [1]=0xd8, [2]=0x36, [3]=0x65, [4]=0x54, [5]=0xcc, [6]=0x75, [7]=0x4c)), ppTInfo=0x52c6c8 | out: ppTInfo=0x52c6c8*=0x533f10) returned 0x0
[0232.645] IUnknown:Release (This=0x532490) returned 0x2
[0232.645] IUnknown:AddRef (This=0x533f10) returned 0x2
[0232.645] DispGetIDsOfNames (in: ptinfo=0x533f10, rgszNames=0x19ef60*="InstancesOf", cNames=0x1, rgdispid=0x19ef50 | out: rgdispid=0x19ef50*=5) returned 0x0
[0232.647] IUnknown:Release (This=0x533f10) returned 0x1
[0232.649] IUnknown:AddRef (This=0x533f10) returned 0x2
[0232.649] ITypeInfo:LocalInvoke (This=0x533f10) returned 0x0
[0232.650] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0232.650] GetCurrentThreadId () returned 0x704
[0232.651] WbemLocator:IUnknown:AddRef (This=0x52ed18) returned 0x3
[0232.651] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0232.651] GetCurrentThreadId () returned 0x704
[0232.651] IWbemServices:CreateInstanceEnum (in: This=0x52ed18, strFilter="Win32_BaseBoard", lFlags=16, pCtx=0x0, ppEnum=0x19e764 | out: ppEnum=0x19e764*=0x51d938) returned 0x0
[0232.769] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x502418
[0232.770] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x502718
[0232.770] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5022f8
[0232.770] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52af30
[0232.770] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x520e30
[0232.770] IUnknown:QueryInterface (in: This=0x51d938, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e60c | out: ppvObject=0x19e60c*=0x51d93c) returned 0x0
[0232.770] IClientSecurity:QueryBlanket (in: This=0x51d93c, pProxy=0x51d938, pAuthnSvc=0x19e5f8, pAuthzSvc=0x19e600, pServerPrincName=0x0, pAuthnLevel=0x19e634, pImpLevel=0x19e638, pAuthInfo=0x0, pCapabilites=0x19e5fc | out: pAuthnSvc=0x19e5f8*=0xa, pAuthzSvc=0x19e600*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e634*=0x6, pImpLevel=0x19e638*=0x2, pAuthInfo=0x0, pCapabilites=0x19e5fc*=0x1) returned 0x0
[0232.770] IUnknown:Release (This=0x51d93c) returned 0x1
[0232.770] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0232.770] GetCurrentThreadId () returned 0x704
[0232.770] WbemLocator:IUnknown:QueryInterface (in: This=0x52ed18, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5fc | out: ppvObject=0x19e5fc*=0x517ccc) returned 0x0
[0232.770] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x517ccc, pProxy=0x52ed18, pAuthnSvc=0x19e5e4, pAuthzSvc=0x19e5e8, pServerPrincName=0x0, pAuthnLevel=0x19e5f4, pImpLevel=0x19e5f8, pAuthInfo=0x0, pCapabilites=0x19e5ec | out: pAuthnSvc=0x19e5e4*=0xa, pAuthzSvc=0x19e5e8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e5f4*=0x6, pImpLevel=0x19e5f8*=0x3, pAuthInfo=0x0, pCapabilites=0x19e5ec*=0x20) returned 0x0
[0232.770] WbemLocator:IUnknown:Release (This=0x517ccc) returned 0x3
[0232.771] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0232.771] GetCurrentThreadId () returned 0x704
[0232.771] WbemLocator:IUnknown:QueryInterface (in: This=0x52ed18, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e5fc | out: ppvObject=0x19e5fc*=0x517ccc) returned 0x0
[0232.771] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x517ccc, pProxy=0x52ed18, pAuthnSvc=0x19e5e4, pAuthzSvc=0x19e5e8, pServerPrincName=0x0, pAuthnLevel=0x19e5f8, pImpLevel=0x19e5f4, pAuthInfo=0x0, pCapabilites=0x19e5ec | out: pAuthnSvc=0x19e5e4*=0xa, pAuthzSvc=0x19e5e8*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e5f8*=0x6, pImpLevel=0x19e5f4*=0x3, pAuthInfo=0x0, pCapabilites=0x19e5ec*=0x20) returned 0x0
[0232.771] WbemLocator:IUnknown:Release (This=0x517ccc) returned 0x3
[0232.771] IUnknown:QueryInterface (in: This=0x51d938, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e62c | out: ppvObject=0x19e62c*=0x51d93c) returned 0x0
[0232.772] IClientSecurity:CopyProxy (in: This=0x51d93c, pProxy=0x51d938, ppCopy=0x19e630 | out: ppCopy=0x19e630*=0x51d2f8) returned 0x0
[0232.826] IUnknown:QueryInterface (in: This=0x51d2f8, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e584 | out: ppvObject=0x19e584*=0x51d2fc) returned 0x0
[0232.838] IClientSecurity:QueryBlanket (in: This=0x51d2fc, pProxy=0x51d2f8, pAuthnSvc=0x19e5b4, pAuthzSvc=0x19e5b0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x19e5b4*=0xa, pAuthzSvc=0x19e5b0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0
[0232.839] IUnknown:Release (This=0x51d2fc) returned 0x3
[0232.839] IUnknown:QueryInterface (in: This=0x51d2f8, riid=0x715b1f08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e568 | out: ppvObject=0x19e568*=0x5186f0) returned 0x0
[0232.839] IUnknown:QueryInterface (in: This=0x51d2f8, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e56c | out: ppvObject=0x19e56c*=0x51d2fc) returned 0x0
[0232.839] IClientSecurity:SetBlanket (This=0x51d2fc, pProxy=0x51d2f8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
[0233.244] IUnknown:Release (This=0x51d2fc) returned 0x4
[0233.244] WbemLocator:IUnknown:Release (This=0x5186f0) returned 0x3
[0233.244] IUnknown:Release (This=0x51d93c) returned 0x2
[0233.244] IUnknown:AddRef (This=0x51d2f8) returned 0x3
[0233.244] IUnknown:Release (This=0x51d938) returned 0x2
[0233.244] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19e720 | out: pperrinfo=0x19e720*=0x0) returned 0x1
[0233.245] WbemLocator:IUnknown:Release (This=0x52ed18) returned 0x2
[0233.245] IUnknown:Release (This=0x533f10) returned 0x1
[0233.246] LoadRegTypeLib (in: rguid=0x715b2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x19e734*=0x0 | out: pptlib=0x19e734*=0x532490) returned 0x0
[0233.247] ITypeLib:GetTypeInfoOfGuid (in: This=0x532490, GUID=0x502450*(Data1=0x4b83d61, Data2=0x21ae, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x33, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x502438 | out: ppTInfo=0x502438*=0x534018) returned 0x0
[0233.248] IUnknown:Release (This=0x532490) returned 0x3
[0233.248] IUnknown:AddRef (This=0x534018) returned 0x2
[0233.248] ITypeInfo:RemoteGetTypeAttr (in: This=0x534018, ppTypeAttr=0x19e770, pDummy=0x86a8ab45 | out: ppTypeAttr=0x19e770, pDummy=0x86a8ab45) returned 0x0
[0233.249] ITypeInfo:LocalReleaseTypeAttr (This=0x534018) returned 0x0
[0233.249] IUnknown:Release (This=0x534018) returned 0x1
[0233.250] CoGetContextToken (in: pToken=0x19e2d0 | out: pToken=0x19e2d0) returned 0x0
[0233.250] CoGetContextToken (in: pToken=0x19e6d8 | out: pToken=0x19e6d8) returned 0x0
[0233.250] CoGetContextToken (in: pToken=0x19f2b0 | out: pToken=0x19f2b0) returned 0x0
[0233.250] CoGetContextToken (in: pToken=0x19f210 | out: pToken=0x19f210) returned 0x0
[0233.251] CoGetContextToken (in: pToken=0x19f230 | out: pToken=0x19f230) returned 0x0
[0233.251] LoadRegTypeLib (in: rguid=0x715b2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x400, pptlib=0x19f220*=0x0 | out: pptlib=0x19f220*=0x532490) returned 0x0
[0233.252] ITypeLib:GetTypeInfoOfGuid (in: This=0x532490, GUID=0x502440*(Data1=0x76a6415f, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), ppTInfo=0x502434 | out: ppTInfo=0x502434*=0x533fc0) returned 0x0
[0233.253] IUnknown:Release (This=0x532490) returned 0x4
[0233.253] IUnknown:AddRef (This=0x533fc0) returned 0x2
[0233.253] ITypeInfo:LocalInvoke (This=0x533fc0) returned 0x0
[0233.253] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0233.253] GetCurrentThreadId () returned 0x704
[0233.253] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5364d8
[0233.253] IUnknown:Release (This=0x533fc0) returned 0x1
[0233.253] ?WbemMemFree@CWin32DefaultArena@@SAHPAX@Z () returned 0x1
[0233.773] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x4fdad0
[0233.820] LocalAlloc (uFlags=0x0, uBytes=0x80) returned 0x4fde00
[0234.215] CoGetContextToken (in: pToken=0x19ef60 | out: pToken=0x19ef60) returned 0x0
[0234.376] CoGetContextToken (in: pToken=0x19ea60 | out: pToken=0x19ea60) returned 0x0
[0234.376] IUnknown:AddRef (This=0x533fc0) returned 0x2
[0234.377] ITypeInfo:LocalInvoke (This=0x533fc0) returned 0x0
[0234.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0234.377] GetCurrentThreadId () returned 0x704
[0234.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0234.377] GetCurrentThreadId () returned 0x704
[0234.377] IUnknown:AddRef (This=0x51d2f8) returned 0x3
[0234.377] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0234.377] GetCurrentThreadId () returned 0x704
[0234.377] IEnumWbemClassObject:Clone (in: This=0x51d2f8, ppEnum=0x19ea90 | out: ppEnum=0x19ea90*=0x51d7a8) returned 0x0
[0234.478] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x542ad0
[0234.478] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x542b90
[0234.478] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x542c50
[0234.478] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52b070
[0234.478] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x521110
[0234.478] IUnknown:QueryInterface (in: This=0x51d7a8, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e93c | out: ppvObject=0x19e93c*=0x51d7ac) returned 0x0
[0234.479] IClientSecurity:QueryBlanket (in: This=0x51d7ac, pProxy=0x51d7a8, pAuthnSvc=0x19e928, pAuthzSvc=0x19e930, pServerPrincName=0x0, pAuthnLevel=0x19e964, pImpLevel=0x19e968, pAuthInfo=0x0, pCapabilites=0x19e92c | out: pAuthnSvc=0x19e928*=0xa, pAuthzSvc=0x19e930*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e964*=0x6, pImpLevel=0x19e968*=0x2, pAuthInfo=0x0, pCapabilites=0x19e92c*=0x1) returned 0x0
[0234.479] IUnknown:Release (This=0x51d7ac) returned 0x1
[0234.479] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0234.479] GetCurrentThreadId () returned 0x704
[0234.479] IUnknown:QueryInterface (in: This=0x51d2f8, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e92c | out: ppvObject=0x19e92c*=0x51d2fc) returned 0x0
[0234.479] IClientSecurity:QueryBlanket (in: This=0x51d2fc, pProxy=0x51d2f8, pAuthnSvc=0x19e914, pAuthzSvc=0x19e918, pServerPrincName=0x0, pAuthnLevel=0x19e924, pImpLevel=0x19e928, pAuthInfo=0x0, pCapabilites=0x19e91c | out: pAuthnSvc=0x19e914*=0xa, pAuthzSvc=0x19e918*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e924*=0x6, pImpLevel=0x19e928*=0x3, pAuthInfo=0x0, pCapabilites=0x19e91c*=0x20) returned 0x0
[0234.479] IUnknown:Release (This=0x51d2fc) returned 0x3
[0234.479] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0234.479] GetCurrentThreadId () returned 0x704
[0234.479] IUnknown:QueryInterface (in: This=0x51d2f8, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e92c | out: ppvObject=0x19e92c*=0x51d2fc) returned 0x0
[0234.480] IClientSecurity:QueryBlanket (in: This=0x51d2fc, pProxy=0x51d2f8, pAuthnSvc=0x19e914, pAuthzSvc=0x19e918, pServerPrincName=0x0, pAuthnLevel=0x19e928, pImpLevel=0x19e924, pAuthInfo=0x0, pCapabilites=0x19e91c | out: pAuthnSvc=0x19e914*=0xa, pAuthzSvc=0x19e918*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19e928*=0x6, pImpLevel=0x19e924*=0x3, pAuthInfo=0x0, pCapabilites=0x19e91c*=0x20) returned 0x0
[0234.480] IUnknown:Release (This=0x51d2fc) returned 0x3
[0234.480] IUnknown:QueryInterface (in: This=0x51d7a8, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e95c | out: ppvObject=0x19e95c*=0x51d7ac) returned 0x0
[0234.480] IClientSecurity:CopyProxy (in: This=0x51d7ac, pProxy=0x51d7a8, ppCopy=0x19e960 | out: ppCopy=0x19e960*=0x51ccb8) returned 0x0
[0234.480] IUnknown:QueryInterface (in: This=0x51ccb8, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e8b4 | out: ppvObject=0x19e8b4*=0x51ccbc) returned 0x0
[0234.480] IClientSecurity:QueryBlanket (in: This=0x51ccbc, pProxy=0x51ccb8, pAuthnSvc=0x19e8e4, pAuthzSvc=0x19e8e0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0 | out: pAuthnSvc=0x19e8e4*=0xa, pAuthzSvc=0x19e8e0*=0x0, pServerPrincName=0x0, pAuthnLevel=0x0, pImpLevel=0x0, pAuthInfo=0x0, pCapabilites=0x0) returned 0x0
[0234.480] IUnknown:Release (This=0x51ccbc) returned 0x3
[0234.480] IUnknown:QueryInterface (in: This=0x51ccb8, riid=0x715b1f08*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e898 | out: ppvObject=0x19e898*=0x517bf0) returned 0x0
[0234.480] IUnknown:QueryInterface (in: This=0x51ccb8, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e89c | out: ppvObject=0x19e89c*=0x51ccbc) returned 0x0
[0234.480] IClientSecurity:SetBlanket (This=0x51ccbc, pProxy=0x51ccb8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
[0234.567] IUnknown:Release (This=0x51ccbc) returned 0x4
[0234.567] WbemLocator:IUnknown:Release (This=0x517bf0) returned 0x3
[0234.567] IUnknown:Release (This=0x51d7ac) returned 0x2
[0234.567] IUnknown:AddRef (This=0x51ccb8) returned 0x3
[0234.568] IUnknown:Release (This=0x51d7a8) returned 0x2
[0234.568] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19ea50 | out: pperrinfo=0x19ea50*=0x0) returned 0x1
[0234.568] IUnknown:Release (This=0x51d2f8) returned 0x2
[0234.568] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0234.568] GetCurrentThreadId () returned 0x704
[0234.568] IUnknown:AddRef (This=0x51ccb8) returned 0x3
[0234.568] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0234.568] GetCurrentThreadId () returned 0x704
[0234.569] IEnumWbemClassObject:Reset (This=0x51ccb8) returned 0x0
[0234.683] IUnknown:Release (This=0x51ccb8) returned 0x2
[0234.683] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x536610
[0234.683] IUnknown:Release (This=0x533fc0) returned 0x1
[0234.777] CoGetContextToken (in: pToken=0x19e248 | out: pToken=0x19e248) returned 0x0
[0234.778] CoGetContextToken (in: pToken=0x19e650 | out: pToken=0x19e650) returned 0x0
[0234.886] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0
[0234.886] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0234.886] GetCurrentThreadId () returned 0x704
[0234.887] IUnknown:AddRef (This=0x51ccb8) returned 0x3
[0234.887] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0234.887] GetCurrentThreadId () returned 0x704
[0234.887] IEnumWbemClassObject:Next (in: This=0x51ccb8, lTimeout=-1, uCount=0x1, apObjects=0x19f3bc, puReturned=0x19f39c | out: apObjects=0x19f3bc*=0x5469c0, puReturned=0x19f39c*=0x1) returned 0x0
[0235.133] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52ddd8
[0235.133] IUnknown:AddRef (This=0x5469c0) returned 0x2
[0235.133] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x4f4d88
[0235.133] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x542b30
[0235.133] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x5429b0
[0235.133] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52af70
[0235.133] WbemLocator:IUnknown:AddRef (This=0x52ed18) returned 0x3
[0235.133] IUnknown:AddRef (This=0x51ccb8) returned 0x4
[0235.133] IUnknown:QueryInterface (in: This=0x51ccb8, riid=0x715b1f48*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f3e8 | out: ppvObject=0x19f3e8*=0x51ccbc) returned 0x0
[0235.134] IClientSecurity:QueryBlanket (in: This=0x51ccbc, pProxy=0x51ccb8, pAuthnSvc=0x19f36c, pAuthzSvc=0x19f374, pServerPrincName=0x0, pAuthnLevel=0x19f398, pImpLevel=0x19f3a4, pAuthInfo=0x0, pCapabilites=0x19f368 | out: pAuthnSvc=0x19f36c*=0xa, pAuthzSvc=0x19f374*=0x0, pServerPrincName=0x0, pAuthnLevel=0x19f398*=0x6, pImpLevel=0x19f3a4*=0x3, pAuthInfo=0x0, pCapabilites=0x19f368*=0x20) returned 0x0
[0235.134] IUnknown:Release (This=0x51ccbc) returned 0x4
[0235.134] WbemLocator:IUnknown:Release (This=0x52ed18) returned 0x2
[0235.134] WbemLocator:IUnknown:AddRef (This=0x52ed18) returned 0x3
[0235.134] IUnknown:Release (This=0x51ccb8) returned 0x3
[0235.134] SysStringLen (param_1="\\\\.\\root\\cimv2") returned 0xe
[0235.134] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x53b680
[0235.134] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x52b050
[0235.134] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x537c48
[0235.134] IUnknown:AddRef (This=0x5469c0) returned 0x3
[0235.134] IUnknown:Release (This=0x5469c0) returned 0x2
[0235.134] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f334 | out: pperrinfo=0x19f334*=0x0) returned 0x1
[0235.134] IUnknown:Release (This=0x51ccb8) returned 0x2
[0235.134] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f3ec | out: pperrinfo=0x19f3ec*=0x0) returned 0x1
[0235.135] LoadRegTypeLib (in: rguid=0x715b2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, pptlib=0x19eb94*=0x0 | out: pptlib=0x19eb94*=0x532490) returned 0x0
[0235.138] ITypeLib:GetTypeInfoOfGuid (in: This=0x532490, GUID=0x715b4c08*(Data1=0xd6bdafb2, Data2=0x9435, Data3=0x491f, Data4=([0]=0xbb, [1]=0x87, [2]=0x6a, [3]=0xa0, [4]=0xf0, [5]=0xbc, [6]=0x31, [7]=0xa2)), ppTInfo=0x53b69c | out: ppTInfo=0x53b69c*=0x534044) returned 0x0
[0235.138] IUnknown:Release (This=0x532490) returned 0x5
[0235.138] IUnknown:AddRef (This=0x534044) returned 0x2
[0235.138] ITypeInfo:RemoteGetTypeAttr (in: This=0x534044, ppTypeAttr=0x19ebd0, pDummy=0x86a8a725 | out: ppTypeAttr=0x19ebd0, pDummy=0x86a8a725) returned 0x0
[0235.141] ITypeInfo:LocalReleaseTypeAttr (This=0x534044) returned 0x0
[0235.141] IUnknown:Release (This=0x534044) returned 0x1
[0235.143] CoGetContextToken (in: pToken=0x19e730 | out: pToken=0x19e730) returned 0x0
[0235.143] CoGetContextToken (in: pToken=0x19eb38 | out: pToken=0x19eb38) returned 0x0
[0235.152] CoGetContextToken (in: pToken=0x19ef00 | out: pToken=0x19ef00) returned 0x0
[0235.152] LoadRegTypeLib (in: rguid=0x715b2198*(Data1=0x565783c6, Data2=0xcb41, Data3=0x11d1, Data4=([0]=0x8b, [1]=0x2, [2]=0x0, [3]=0x60, [4]=0x8, [5]=0x6, [6]=0xd9, [7]=0xb6)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x409, pptlib=0x19eee8*=0x0 | out: pptlib=0x19eee8*=0x532490) returned 0x0
[0235.156] ITypeLib:GetTypeInfoOfGuid (in: This=0x532490, GUID=0x715b1e68*(Data1=0x269ad56a, Data2=0x8a67, Data3=0x4129, Data4=([0]=0xbc, [1]=0x8c, [2]=0x5, [3]=0x6, [4]=0xdc, [5]=0xfe, [6]=0x98, [7]=0x80)), ppTInfo=0x53b698 | out: ppTInfo=0x53b698*=0x534070) returned 0x0
[0235.156] IUnknown:Release (This=0x532490) returned 0x6
[0235.156] IUnknown:AddRef (This=0x534070) returned 0x2
[0235.156] DispGetIDsOfNames (in: ptinfo=0x534070, rgszNames=0x19ef70*="SerialNumber", cNames=0x1, rgdispid=0x19ef60 | out: rgdispid=0x19ef60*=-1) returned 0x80020006
[0235.256] IUnknown:AddRef (This=0x5469c0) returned 0x3
[0235.256] IWbemClassObject:Get (in: This=0x5469c0, wszName="SerialNumber", lFlags=0, pVal=0x0, pType=0x0, plFlavor=0x19eeb8*=0 | out: pVal=0x0, pType=0x0, plFlavor=0x19eeb8*=0) returned 0x0
[0235.256] IUnknown:Release (This=0x5469c0) returned 0x2
[0235.256] SysStringLen (param_1="SerialNumber") returned 0xc
[0235.256] ?WbemMemAlloc@CWin32DefaultArena@@SAPAXK@Z () returned 0x536e10
[0235.256] SysStringLen (param_1="SerialNumber") returned 0xc
[0235.256] IUnknown:Release (This=0x534070) returned 0x1
[0235.256] IUnknown:AddRef (This=0x534070) returned 0x2
[0235.256] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0235.256] GetCurrentThreadId () returned 0x704
[0235.256] SysStringLen (param_1="SerialNumber") returned 0xc
[0235.257] IWbemClassObject:Get (in: This=0x5469c0, wszName="SerialNumber", lFlags=0, pVal=0x19ed00*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19ecf8*=0, plFlavor=0x0 | out: pVal=0x19ed00*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="..XXXXXXXXXXXXX.", varVal2=0x0), pType=0x19ecf8*=8, plFlavor=0x0) returned 0x0
[0235.258] IUnknown:Release (This=0x534070) returned 0x1
[0235.258] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20
[0235.258] SysStringByteLen (bstr="..XXXXXXXXXXXXX.") returned 0x20
[0235.446] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0
[0235.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0235.446] GetCurrentThreadId () returned 0x704
[0235.446] IUnknown:AddRef (This=0x51ccb8) returned 0x3
[0235.446] SetErrorInfo (dwReserved=0x0, perrinfo=0x0) returned 0x0
[0235.446] GetCurrentThreadId () returned 0x704
[0235.446] IEnumWbemClassObject:Next (in: This=0x51ccb8, lTimeout=-1, uCount=0x1, apObjects=0x19f3bc, puReturned=0x19f39c | out: apObjects=0x19f3bc*=0x0, puReturned=0x19f39c*=0x0) returned 0x1
[0235.498] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f334 | out: pperrinfo=0x19f334*=0x0) returned 0x1
[0235.499] IUnknown:Release (This=0x51ccb8) returned 0x2
[0235.499] GetErrorInfo (in: dwReserved=0x0, pperrinfo=0x19f3ec | out: pperrinfo=0x19f3ec*=0x0) returned 0x1
[0235.805] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c0
[0235.806] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3c8
[0235.868] SetEvent (hEvent=0x3c8) returned 1
[0235.898] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f3c4*=0x3c0, lpdwindex=0x19f1e4 | out: lpdwindex=0x19f1e4) returned 0x0
[0235.999] CoGetContextToken (in: pToken=0x19f290 | out: pToken=0x19f290) returned 0x0
[0235.999] CoGetContextToken (in: pToken=0x19f1f0 | out: pToken=0x19f1f0) returned 0x0
[0235.999] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d498, riid=0x19f2c0*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f2bc | out: ppvObject=0x19f2bc*=0x54d498) returned 0x0
[0235.999] WbemDefPath:IUnknown:AddRef (This=0x54d498) returned 0x3
[0235.999] WbemDefPath:IUnknown:Release (This=0x54d498) returned 0x2
[0236.003] WbemDefPath:IWbemPath:SetText (This=0x54d498, uMode=0x4, pszPath="win32_processor") returned 0x0
[0236.004] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x54d498, puCount=0x19f444 | out: puCount=0x19f444*=0x0) returned 0x0
[0236.005] WbemDefPath:IWbemPath:GetText (in: This=0x54d498, lFlags=2, puBuffLength=0x19f440*=0x0, pszText=0x0 | out: puBuffLength=0x19f440*=0x10, pszText=0x0) returned 0x0
[0236.005] WbemDefPath:IWbemPath:GetText (in: This=0x54d498, lFlags=2, puBuffLength=0x19f440*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f440*=0x10, pszText="win32_processor") returned 0x0
[0236.005] WbemDefPath:IWbemPath:GetInfo (in: This=0x54d498, uRequestedInfo=0x0, puResponse=0x19f44c | out: puResponse=0x19f44c*=0xc15) returned 0x0
[0236.005] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x54d498, puCount=0x19f444 | out: puCount=0x19f444*=0x0) returned 0x0
[0236.005] WbemDefPath:IWbemPath:GetInfo (in: This=0x54d498, uRequestedInfo=0x0, puResponse=0x19f44c | out: puResponse=0x19f44c*=0xc15) returned 0x0
[0236.006] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x54d498, puCount=0x19f434 | out: puCount=0x19f434*=0x0) returned 0x0
[0236.006] WbemDefPath:IWbemPath:GetText (in: This=0x54d498, lFlags=2, puBuffLength=0x19f430*=0x0, pszText=0x0 | out: puBuffLength=0x19f430*=0x10, pszText=0x0) returned 0x0
[0236.006] WbemDefPath:IWbemPath:GetText (in: This=0x54d498, lFlags=2, puBuffLength=0x19f430*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f430*=0x10, pszText="win32_processor") returned 0x0
[0236.006] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x54d498, puCount=0x19f434 | out: puCount=0x19f434*=0x0) returned 0x0
[0236.006] WbemDefPath:IWbemPath:GetText (in: This=0x54d498, lFlags=2, puBuffLength=0x19f430*=0x0, pszText=0x0 | out: puBuffLength=0x19f430*=0x10, pszText=0x0) returned 0x0
[0236.006] WbemDefPath:IWbemPath:GetText (in: This=0x54d498, lFlags=2, puBuffLength=0x19f430*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f430*=0x10, pszText="win32_processor") returned 0x0
[0236.007] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x54d498, puCount=0x19f3c4 | out: puCount=0x19f3c4*=0x0) returned 0x0
[0236.007] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f0
[0236.007] SetEvent (hEvent=0x3c8) returned 1
[0236.008] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19ec24*=0x3f0, lpdwindex=0x19ea44 | out: lpdwindex=0x19ea44) returned 0x0
[0236.013] CoGetContextToken (in: pToken=0x19eaf0 | out: pToken=0x19eaf0) returned 0x0
[0236.013] CoGetContextToken (in: pToken=0x19ea50 | out: pToken=0x19ea50) returned 0x0
[0236.013] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d428, riid=0x19eb20*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19eb1c | out: ppvObject=0x19eb1c*=0x54d428) returned 0x0
[0236.014] WbemDefPath:IUnknown:AddRef (This=0x54d428) returned 0x3
[0236.014] WbemDefPath:IUnknown:Release (This=0x54d428) returned 0x2
[0236.014] WbemDefPath:IWbemPath:SetText (This=0x54d428, uMode=0x4, pszPath="//./root/cimv2") returned 0x0
[0236.014] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x54d428, puCount=0x19f3b0 | out: puCount=0x19f3b0*=0x2) returned 0x0
[0236.014] WbemDefPath:IWbemPath:GetText (in: This=0x54d428, lFlags=4, puBuffLength=0x19f3ac*=0x0, pszText=0x0 | out: puBuffLength=0x19f3ac*=0xf, pszText=0x0) returned 0x0
[0236.014] WbemDefPath:IWbemPath:GetText (in: This=0x54d428, lFlags=4, puBuffLength=0x19f3ac*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3ac*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
[0236.014] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x3f4
[0236.014] SetEvent (hEvent=0x3c8) returned 1
[0236.015] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f30c*=0x3f4, lpdwindex=0x19f12c | out: lpdwindex=0x19f12c) returned 0x0
[0236.017] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0
[0236.017] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0
[0236.017] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d268, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x54d268) returned 0x0
[0236.017] WbemDefPath:IUnknown:AddRef (This=0x54d268) returned 0x3
[0236.017] WbemDefPath:IUnknown:Release (This=0x54d268) returned 0x2
[0236.017] WbemDefPath:IWbemPath:SetText (This=0x54d268, uMode=0x4, pszPath="\\\\.\\root\\cimv2") returned 0x0
[0236.017] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x54d268, puCount=0x19f388 | out: puCount=0x19f388*=0x2) returned 0x0
[0236.017] WbemDefPath:IWbemPath:GetText (in: This=0x54d268, lFlags=4, puBuffLength=0x19f384*=0x0, pszText=0x0 | out: puBuffLength=0x19f384*=0xf, pszText=0x0) returned 0x0
[0236.018] WbemDefPath:IWbemPath:GetText (in: This=0x54d268, lFlags=4, puBuffLength=0x19f384*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f384*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
[0236.072] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f2a8*=0x40c, lpdwindex=0x19f15c | out: lpdwindex=0x19f15c) returned 0x0
[0238.244] CoGetContextToken (in: pToken=0x19f0a0 | out: pToken=0x19f0a0) returned 0x0
[0238.244] CoGetContextToken (in: pToken=0x19f048 | out: pToken=0x19f048) returned 0x0
[0238.244] IUnknown:QueryInterface (in: This=0x4f0128, riid=0x6c0a8724*(Data1=0x1da, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f028 | out: ppvObject=0x19f028*=0x4f0138) returned 0x0
[0238.244] CObjectContext::ContextCallback () returned 0x0
[0238.296] IUnknown:Release (This=0x4f0138) returned 0x1
[0238.297] CoUnmarshalInterface (in: pStm=0x52afb0, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f090 | out: ppv=0x19f090*=0x518ff0) returned 0x0
[0238.297] CoMarshalInterface (pStm=0x52afb0, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x518ff0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0
[0238.298] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ef34 | out: ppvObject=0x19ef34*=0x518ff0) returned 0x0
[0238.298] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x6c12fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19eef0 | out: ppvObject=0x19eef0*=0x0) returned 0x80004002
[0238.299] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x6c12fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ed0c | out: ppvObject=0x19ed0c*=0x0) returned 0x80004002
[0238.299] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x6c13056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19eae4 | out: ppvObject=0x19eae4*=0x0) returned 0x80004002
[0238.301] WbemLocator:IUnknown:AddRef (This=0x518ff0) returned 0x3
[0238.301] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x6c130208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e84c | out: ppvObject=0x19e84c*=0x0) returned 0x80004002
[0238.301] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x6c13015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e7fc | out: ppvObject=0x19e7fc*=0x0) returned 0x80004002
[0238.301] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x6c0040e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e808 | out: ppvObject=0x19e808*=0x518f4c) returned 0x0
[0238.301] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x518f4c, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e810 | out: pCid=0x19e810*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
[0238.301] WbemLocator:IUnknown:Release (This=0x518f4c) returned 0x3
[0238.301] CoGetContextToken (in: pToken=0x19e868 | out: pToken=0x19e868) returned 0x0
[0238.301] CoGetContextToken (in: pToken=0x19ec70 | out: pToken=0x19ec70) returned 0x0
[0238.301] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x6c130448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ed00 | out: ppvObject=0x19ed00*=0x518fd4) returned 0x0
[0238.301] WbemLocator:IRpcOptions:Query (in: This=0x518fd4, pPrx=0x518ff0, dwProperty=2, pdwValue=0x19ed28 | out: pdwValue=0x19ed28) returned 0x0
[0238.301] WbemLocator:IUnknown:Release (This=0x518fd4) returned 0x3
[0238.301] WbemLocator:IUnknown:Release (This=0x518ff0) returned 0x2
[0238.302] WbemLocator:IUnknown:Release (This=0x518ff0) returned 0x1
[0238.302] CoGetContextToken (in: pToken=0x19efe0 | out: pToken=0x19efe0) returned 0x0
[0238.302] WbemLocator:IUnknown:AddRef (This=0x518ff0) returned 0x2
[0238.302] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x69431104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x518fcc) returned 0x0
[0238.302] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x518fcc, pProxy=0x518ff0, pAuthnSvc=0x19f2ec, pAuthzSvc=0x19f2e8, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4, pImpLevel=0x19f2d4, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc | out: pAuthnSvc=0x19f2ec*=0xa, pAuthzSvc=0x19f2e8*=0x0, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4*=0x6, pImpLevel=0x19f2d4*=0x2, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc*=0x1) returned 0x0
[0238.302] WbemLocator:IUnknown:Release (This=0x518fcc) returned 0x2
[0238.302] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x694310f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f290 | out: ppvObject=0x19f290*=0x518ff0) returned 0x0
[0238.303] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x69431104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f28c | out: ppvObject=0x19f28c*=0x518fcc) returned 0x0
[0238.303] WbemLocator:IClientSecurity:SetBlanket (This=0x518fcc, pProxy=0x518ff0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
[0238.303] WbemLocator:IUnknown:Release (This=0x518fcc) returned 0x3
[0238.303] WbemLocator:IUnknown:Release (This=0x518ff0) returned 0x2
[0238.303] CoTaskMemFree (pv=0x553880)
[0238.303] WbemLocator:IUnknown:Release (This=0x518ff0) returned 0x1
[0238.303] SysStringLen (param_1=0x0) returned 0x0
[0238.303] CoGetContextToken (in: pToken=0x19f258 | out: pToken=0x19f258) returned 0x0
[0238.303] CoGetContextToken (in: pToken=0x19f1b8 | out: pToken=0x19f1b8) returned 0x0
[0238.303] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x19f288*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x19f284 | out: ppvObject=0x19f284*=0x52eae8) returned 0x0
[0238.304] WbemLocator:IUnknown:AddRef (This=0x52eae8) returned 0x3
[0238.304] WbemLocator:IUnknown:Release (This=0x52eae8) returned 0x2
[0238.304] CoGetContextToken (in: pToken=0x19f218 | out: pToken=0x19f218) returned 0x0
[0238.305] WbemLocator:IUnknown:AddRef (This=0x52eae8) returned 0x3
[0238.305] WbemLocator:IUnknown:QueryInterface (in: This=0x52eae8, riid=0x69431104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f29c | out: ppvObject=0x19f29c*=0x518fcc) returned 0x0
[0238.305] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x518fcc, pProxy=0x52eae8, pAuthnSvc=0x19f2ec, pAuthzSvc=0x19f2e8, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4, pImpLevel=0x19f2d4, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc | out: pAuthnSvc=0x19f2ec*=0xa, pAuthzSvc=0x19f2e8*=0x0, pServerPrincName=0x19f2e0, pAuthnLevel=0x19f2e4*=0x6, pImpLevel=0x19f2d4*=0x2, pAuthInfo=0x19f2d8, pCapabilites=0x19f2dc*=0x1) returned 0x0
[0238.305] WbemLocator:IUnknown:Release (This=0x518fcc) returned 0x3
[0238.305] WbemLocator:IUnknown:QueryInterface (in: This=0x52eae8, riid=0x694310f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f290 | out: ppvObject=0x19f290*=0x518ff0) returned 0x0
[0238.305] WbemLocator:IUnknown:QueryInterface (in: This=0x52eae8, riid=0x69431104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f28c | out: ppvObject=0x19f28c*=0x518fcc) returned 0x0
[0238.305] WbemLocator:IClientSecurity:SetBlanket (This=0x518fcc, pProxy=0x52eae8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
[0238.305] WbemLocator:IUnknown:Release (This=0x518fcc) returned 0x4
[0238.306] WbemLocator:IUnknown:Release (This=0x518ff0) returned 0x3
[0238.306] CoTaskMemFree (pv=0x5536a0)
[0238.306] WbemLocator:IUnknown:Release (This=0x52eae8) returned 0x2
[0238.306] SysStringLen (param_1=0x0) returned 0x0
[0238.306] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x54d268, puCount=0x19f3ac | out: puCount=0x19f3ac*=0x2) returned 0x0
[0238.306] WbemDefPath:IWbemPath:GetText (in: This=0x54d268, lFlags=4, puBuffLength=0x19f3a8*=0x0, pszText=0x0 | out: puBuffLength=0x19f3a8*=0xf, pszText=0x0) returned 0x0
[0238.306] WbemDefPath:IWbemPath:GetText (in: This=0x54d268, lFlags=4, puBuffLength=0x19f3a8*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3a8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
[0238.306] CoGetContextToken (in: pToken=0x19f018 | out: pToken=0x19f018) returned 0x0
[0238.307] CoUnmarshalInterface (in: pStm=0x52afb0, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x19f008 | out: ppv=0x19f008*=0x518ff0) returned 0x0
[0238.307] CoMarshalInterface (pStm=0x52afb0, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x518ff0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0
[0238.307] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19eeac | out: ppvObject=0x19eeac*=0x518ff0) returned 0x0
[0238.307] WbemLocator:IUnknown:Release (This=0x518ff0) returned 0x3
[0238.307] WbemLocator:IUnknown:Release (This=0x518ff0) returned 0x2
[0238.307] CoGetContextToken (in: pToken=0x19ef58 | out: pToken=0x19ef58) returned 0x0
[0238.308] WbemLocator:IUnknown:AddRef (This=0x518ff0) returned 0x3
[0238.308] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x69431104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x518fcc) returned 0x0
[0238.308] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x518fcc, pProxy=0x518ff0, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x3, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x20) returned 0x0
[0238.308] WbemLocator:IUnknown:Release (This=0x518fcc) returned 0x3
[0238.308] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x694310f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x518ff0) returned 0x0
[0238.308] WbemLocator:IUnknown:QueryInterface (in: This=0x518ff0, riid=0x69431104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x518fcc) returned 0x0
[0238.308] WbemLocator:IClientSecurity:SetBlanket (This=0x518fcc, pProxy=0x518ff0, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
[0238.308] WbemLocator:IUnknown:Release (This=0x518fcc) returned 0x4
[0238.308] WbemLocator:IUnknown:Release (This=0x518ff0) returned 0x3
[0238.309] WbemLocator:IUnknown:Release (This=0x518ff0) returned 0x2
[0238.309] SysStringLen (param_1=0x0) returned 0x0
[0238.309] CoGetContextToken (in: pToken=0x19f1d0 | out: pToken=0x19f1d0) returned 0x0
[0238.309] WbemLocator:IUnknown:AddRef (This=0x52eae8) returned 0x3
[0238.309] WbemLocator:IUnknown:Release (This=0x52eae8) returned 0x2
[0238.309] CoGetContextToken (in: pToken=0x19f190 | out: pToken=0x19f190) returned 0x0
[0238.309] WbemLocator:IUnknown:AddRef (This=0x52eae8) returned 0x3
[0238.309] WbemLocator:IUnknown:QueryInterface (in: This=0x52eae8, riid=0x69431104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f214 | out: ppvObject=0x19f214*=0x518fcc) returned 0x0
[0238.309] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x518fcc, pProxy=0x52eae8, pAuthnSvc=0x19f264, pAuthzSvc=0x19f260, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c, pImpLevel=0x19f24c, pAuthInfo=0x19f250, pCapabilites=0x19f254 | out: pAuthnSvc=0x19f264*=0xa, pAuthzSvc=0x19f260*=0x0, pServerPrincName=0x19f258, pAuthnLevel=0x19f25c*=0x6, pImpLevel=0x19f24c*=0x3, pAuthInfo=0x19f250, pCapabilites=0x19f254*=0x20) returned 0x0
[0238.309] WbemLocator:IUnknown:Release (This=0x518fcc) returned 0x3
[0238.309] WbemLocator:IUnknown:QueryInterface (in: This=0x52eae8, riid=0x694310f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f208 | out: ppvObject=0x19f208*=0x518ff0) returned 0x0
[0238.309] WbemLocator:IUnknown:QueryInterface (in: This=0x52eae8, riid=0x69431104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x518fcc) returned 0x0
[0238.309] WbemLocator:IClientSecurity:SetBlanket (This=0x518fcc, pProxy=0x52eae8, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
[0238.310] WbemLocator:IUnknown:Release (This=0x518fcc) returned 0x4
[0238.310] WbemLocator:IUnknown:Release (This=0x518ff0) returned 0x3
[0238.310] WbemLocator:IUnknown:Release (This=0x52eae8) returned 0x2
[0238.310] SysStringLen (param_1=0x0) returned 0x0
[0238.310] WbemDefPath:IWbemPath:GetText (in: This=0x54d498, lFlags=2, puBuffLength=0x19f3b0*=0x0, pszText=0x0 | out: puBuffLength=0x19f3b0*=0x10, pszText=0x0) returned 0x0
[0238.310] WbemDefPath:IWbemPath:GetText (in: This=0x54d498, lFlags=2, puBuffLength=0x19f3b0*=0x10, pszText="000000000000000" | out: puBuffLength=0x19f3b0*=0x10, pszText="win32_processor") returned 0x0
[0238.323] IWbemServices:GetObject (in: This=0x52eae8, strObjectPath="win32_processor", lFlags=0, pCtx=0x0, ppObject=0x19f364*=0x0, ppCallResult=0x0 | out: ppObject=0x19f364*=0x552840, ppCallResult=0x0) returned 0x0
[0238.396] IWbemClassObject:Get (in: This=0x552840, wszName="__PATH", lFlags=0, pVal=0x19f34c*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f3f4*=0, plFlavor=0x19f3f0*=0 | out: pVal=0x19f34c*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor", varVal2=0x0), pType=0x19f3f4*=8, plFlavor=0x19f3f0*=64) returned 0x0
[0238.402] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor") returned 0x46
[0238.402] SysStringByteLen (bstr="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor") returned 0x46
[0238.403] CreateEventW (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x444
[0238.403] SetEvent (hEvent=0x3c8) returned 1
[0238.403] CoWaitForMultipleHandles (in: dwFlags=0x2, dwTimeout=0xffffffff, cHandles=0x1, pHandles=0x19f308*=0x444, lpdwindex=0x19f124 | out: lpdwindex=0x19f124) returned 0x0
[0238.407] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0
[0238.407] CoGetContextToken (in: pToken=0x19f138 | out: pToken=0x19f138) returned 0x0
[0238.407] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d578, riid=0x19f208*(Data1=0x3bc15af2, Data2=0x736c, Data3=0x477e, Data4=([0]=0x9e, [1]=0x51, [2]=0x23, [3]=0x8a, [4]=0xf8, [5]=0x66, [6]=0x7d, [7]=0xcc)), ppvObject=0x19f204 | out: ppvObject=0x19f204*=0x54d578) returned 0x0
[0238.407] WbemDefPath:IUnknown:AddRef (This=0x54d578) returned 0x3
[0238.407] WbemDefPath:IUnknown:Release (This=0x54d578) returned 0x2
[0238.407] WbemDefPath:IWbemPath:SetText (This=0x54d578, uMode=0x4, pszPath="\\\\XC64ZB\\ROOT\\cimv2:Win32_Processor") returned 0x0
[0238.407] IWbemClassObject:Get (in: This=0x552840, wszName="__CLASS", lFlags=0, pVal=0x19f3bc*(varType=0x0, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1=0x0, varVal2=0x0), pType=0x19f43c*=0, plFlavor=0x19f438*=0 | out: pVal=0x19f3bc*(varType=0x8, wReserved1=0x0, wReserved2=0x0, wReserved3=0x0, varVal1="Win32_Processor", varVal2=0x0), pType=0x19f43c*=8, plFlavor=0x19f438*=64) returned 0x0
[0238.407] SysStringByteLen (bstr="Win32_Processor") returned 0x1e
[0238.407] SysStringByteLen (bstr="Win32_Processor") returned 0x1e
[0238.407] CoGetContextToken (in: pToken=0x19f1d8 | out: pToken=0x19f1d8) returned 0x0
[0238.407] WbemLocator:IUnknown:AddRef (This=0x52eae8) returned 0x3
[0238.407] IWbemServices:CreateInstanceEnum (in: This=0x52eae8, strFilter="Win32_Processor", lFlags=17, pCtx=0x0, ppEnum=0x19f3b8 | out: ppEnum=0x19f3b8*=0x51cf10) returned 0x0
[0238.515] IUnknown:QueryInterface (in: This=0x51cf10, riid=0x69431104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f24c | out: ppvObject=0x19f24c*=0x51cf14) returned 0x0
[0238.515] IClientSecurity:QueryBlanket (in: This=0x51cf14, pProxy=0x51cf10, pAuthnSvc=0x19f29c, pAuthzSvc=0x19f298, pServerPrincName=0x19f290, pAuthnLevel=0x19f294, pImpLevel=0x19f284, pAuthInfo=0x19f288, pCapabilites=0x19f28c | out: pAuthnSvc=0x19f29c*=0xa, pAuthzSvc=0x19f298*=0x0, pServerPrincName=0x19f290, pAuthnLevel=0x19f294*=0x6, pImpLevel=0x19f284*=0x2, pAuthInfo=0x19f288, pCapabilites=0x19f28c*=0x1) returned 0x0
[0238.516] IUnknown:Release (This=0x51cf14) returned 0x1
[0238.516] IUnknown:QueryInterface (in: This=0x51cf10, riid=0x694310f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f240 | out: ppvObject=0x19f240*=0x5197f0) returned 0x0
[0238.516] IUnknown:QueryInterface (in: This=0x51cf10, riid=0x69431104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f23c | out: ppvObject=0x19f23c*=0x51cf14) returned 0x0
[0238.516] IClientSecurity:SetBlanket (This=0x51cf14, pProxy=0x51cf10, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
[0238.623] IUnknown:Release (This=0x51cf14) returned 0x2
[0238.623] WbemLocator:IUnknown:Release (This=0x5197f0) returned 0x1
[0238.624] CoTaskMemFree (pv=0x5534c0)
[0238.624] IUnknown:QueryInterface (in: This=0x51cf10, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee34 | out: ppvObject=0x19ee34*=0x5197f0) returned 0x0
[0238.624] WbemLocator:IUnknown:QueryInterface (in: This=0x5197f0, riid=0x6c12fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19edf0 | out: ppvObject=0x19edf0*=0x0) returned 0x80004002
[0238.628] WbemLocator:IUnknown:QueryInterface (in: This=0x5197f0, riid=0x6c12fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec0c | out: ppvObject=0x19ec0c*=0x0) returned 0x80004002
[0238.640] IUnknown:QueryInterface (in: This=0x51cf10, riid=0x6c13056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19e9e4 | out: ppvObject=0x19e9e4*=0x0) returned 0x80004002
[0238.696] WbemLocator:IUnknown:AddRef (This=0x5197f0) returned 0x3
[0238.696] WbemLocator:IUnknown:QueryInterface (in: This=0x5197f0, riid=0x6c130208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e74c | out: ppvObject=0x19e74c*=0x0) returned 0x80004002
[0238.696] WbemLocator:IUnknown:QueryInterface (in: This=0x5197f0, riid=0x6c13015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e6fc | out: ppvObject=0x19e6fc*=0x0) returned 0x80004002
[0238.696] WbemLocator:IUnknown:QueryInterface (in: This=0x5197f0, riid=0x6c0040e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e708 | out: ppvObject=0x19e708*=0x51974c) returned 0x0
[0238.696] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x51974c, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e710 | out: pCid=0x19e710*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
[0238.697] WbemLocator:IUnknown:Release (This=0x51974c) returned 0x3
[0238.697] CoGetContextToken (in: pToken=0x19e768 | out: pToken=0x19e768) returned 0x0
[0238.697] CoGetContextToken (in: pToken=0x19eb70 | out: pToken=0x19eb70) returned 0x0
[0238.697] WbemLocator:IUnknown:QueryInterface (in: This=0x5197f0, riid=0x6c130448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec00 | out: ppvObject=0x19ec00*=0x5197d4) returned 0x0
[0238.697] WbemLocator:IRpcOptions:Query (in: This=0x5197d4, pPrx=0x5197f0, dwProperty=2, pdwValue=0x19ec28 | out: pdwValue=0x19ec28) returned 0x80004002
[0238.697] WbemLocator:IUnknown:Release (This=0x5197d4) returned 0x3
[0238.697] WbemLocator:IUnknown:Release (This=0x5197f0) returned 0x2
[0238.697] CoGetContextToken (in: pToken=0x19f148 | out: pToken=0x19f148) returned 0x0
[0238.697] CoGetContextToken (in: pToken=0x19f0a8 | out: pToken=0x19f0a8) returned 0x0
[0238.698] WbemLocator:IUnknown:QueryInterface (in: This=0x5197f0, riid=0x19f178*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f174 | out: ppvObject=0x19f174*=0x51cf10) returned 0x0
[0238.698] IUnknown:AddRef (This=0x51cf10) returned 0x4
[0238.698] IUnknown:Release (This=0x51cf10) returned 0x3
[0238.698] IUnknown:Release (This=0x51cf10) returned 0x2
[0238.698] WbemLocator:IUnknown:Release (This=0x52eae8) returned 0x2
[0238.698] SysStringLen (param_1=0x0) returned 0x0
[0238.698] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x54d268, puCount=0x19f3f4 | out: puCount=0x19f3f4*=0x2) returned 0x0
[0238.698] WbemDefPath:IWbemPath:GetText (in: This=0x54d268, lFlags=4, puBuffLength=0x19f3f0*=0x0, pszText=0x0 | out: puBuffLength=0x19f3f0*=0xf, pszText=0x0) returned 0x0
[0238.699] WbemDefPath:IWbemPath:GetText (in: This=0x54d268, lFlags=4, puBuffLength=0x19f3f0*=0xf, pszText="00000000000000" | out: puBuffLength=0x19f3f0*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
[0238.699] CoGetContextToken (in: pToken=0x19f238 | out: pToken=0x19f238) returned 0x0
[0238.699] IUnknown:AddRef (This=0x51cf10) returned 0x3
[0238.699] IEnumWbemClassObject:Clone (in: This=0x51cf10, ppEnum=0x19f3f4 | out: ppEnum=0x19f3f4*=0x51cd80) returned 0x0
[0238.746] IUnknown:QueryInterface (in: This=0x51cd80, riid=0x69431104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2b8 | out: ppvObject=0x19f2b8*=0x51cd84) returned 0x0
[0238.747] IClientSecurity:QueryBlanket (in: This=0x51cd84, pProxy=0x51cd80, pAuthnSvc=0x19f308, pAuthzSvc=0x19f304, pServerPrincName=0x19f2fc, pAuthnLevel=0x19f300, pImpLevel=0x19f2f0, pAuthInfo=0x19f2f4, pCapabilites=0x19f2f8 | out: pAuthnSvc=0x19f308*=0xa, pAuthzSvc=0x19f304*=0x0, pServerPrincName=0x19f2fc, pAuthnLevel=0x19f300*=0x6, pImpLevel=0x19f2f0*=0x2, pAuthInfo=0x19f2f4, pCapabilites=0x19f2f8*=0x1) returned 0x0
[0238.747] IUnknown:Release (This=0x51cd84) returned 0x1
[0238.747] IUnknown:QueryInterface (in: This=0x51cd80, riid=0x694310f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2ac | out: ppvObject=0x19f2ac*=0x5184f0) returned 0x0
[0238.747] IUnknown:QueryInterface (in: This=0x51cd80, riid=0x69431104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19f2a8 | out: ppvObject=0x19f2a8*=0x51cd84) returned 0x0
[0238.747] IClientSecurity:SetBlanket (This=0x51cd84, pProxy=0x51cd80, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
[0238.853] IUnknown:Release (This=0x51cd84) returned 0x2
[0238.853] WbemLocator:IUnknown:Release (This=0x5184f0) returned 0x1
[0238.853] CoTaskMemFree (pv=0x5536d0)
[0238.853] IUnknown:QueryInterface (in: This=0x51cd80, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ee94 | out: ppvObject=0x19ee94*=0x5184f0) returned 0x0
[0238.854] WbemLocator:IUnknown:QueryInterface (in: This=0x5184f0, riid=0x6c12fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x19ee50 | out: ppvObject=0x19ee50*=0x0) returned 0x80004002
[0238.877] WbemLocator:IUnknown:QueryInterface (in: This=0x5184f0, riid=0x6c12fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x19ec6c | out: ppvObject=0x19ec6c*=0x0) returned 0x80004002
[0239.033] IUnknown:QueryInterface (in: This=0x51cd80, riid=0x6c13056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x19ea44 | out: ppvObject=0x19ea44*=0x0) returned 0x80004002
[0239.112] WbemLocator:IUnknown:AddRef (This=0x5184f0) returned 0x3
[0239.249] WbemLocator:IUnknown:QueryInterface (in: This=0x5184f0, riid=0x6c130208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x19e7ac | out: ppvObject=0x19e7ac*=0x0) returned 0x80004002
[0239.249] WbemLocator:IUnknown:QueryInterface (in: This=0x5184f0, riid=0x6c13015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x19e75c | out: ppvObject=0x19e75c*=0x0) returned 0x80004002
[0239.249] WbemLocator:IUnknown:QueryInterface (in: This=0x5184f0, riid=0x6c0040e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19e768 | out: ppvObject=0x19e768*=0x51844c) returned 0x0
[0239.249] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x51844c, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x19e770 | out: pCid=0x19e770*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
[0239.249] WbemLocator:IUnknown:Release (This=0x51844c) returned 0x3
[0239.249] CoGetContextToken (in: pToken=0x19e7c8 | out: pToken=0x19e7c8) returned 0x0
[0239.249] CoGetContextToken (in: pToken=0x19ebd0 | out: pToken=0x19ebd0) returned 0x0
[0239.249] WbemLocator:IUnknown:QueryInterface (in: This=0x5184f0, riid=0x6c130448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x19ec60 | out: ppvObject=0x19ec60*=0x5184d4) returned 0x0
[0239.250] WbemLocator:IRpcOptions:Query (in: This=0x5184d4, pPrx=0x5184f0, dwProperty=2, pdwValue=0x19ec88 | out: pdwValue=0x19ec88) returned 0x80004002
[0239.250] WbemLocator:IUnknown:Release (This=0x5184d4) returned 0x3
[0239.250] WbemLocator:IUnknown:Release (This=0x5184f0) returned 0x2
[0239.250] CoGetContextToken (in: pToken=0x19f1a8 | out: pToken=0x19f1a8) returned 0x0
[0239.250] CoGetContextToken (in: pToken=0x19f108 | out: pToken=0x19f108) returned 0x0
[0239.250] WbemLocator:IUnknown:QueryInterface (in: This=0x5184f0, riid=0x19f1d8*(Data1=0x27947e1, Data2=0xd731, Data3=0x11ce, Data4=([0]=0xa3, [1]=0x57, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x1)), ppvObject=0x19f1d4 | out: ppvObject=0x19f1d4*=0x51cd80) returned 0x0
[0239.250] IUnknown:AddRef (This=0x51cd80) returned 0x4
[0239.250] IUnknown:Release (This=0x51cd80) returned 0x3
[0239.250] IUnknown:Release (This=0x51cd80) returned 0x2
[0239.250] IUnknown:Release (This=0x51cf10) returned 0x2
[0239.250] SysStringLen (param_1=0x0) returned 0x0
[0239.251] IEnumWbemClassObject:Reset (This=0x51cd80) returned 0x0
[0239.608] CoTaskMemAlloc (cb=0x4) returned 0x54dae8
[0239.609] IEnumWbemClassObject:Next (This=0x51cd80, lTimeout=-1, uCount=0x1, apObjects=0x54dae8, puReturned=0x22a5598)
Thread:
id = 114
os_tid = 0x7c8
Thread:
id = 115
os_tid = 0x129c
Thread:
id = 116
os_tid = 0x1298
[0226.858] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0226.858] RoInitialize () returned 0x1
[0226.858] RoUninitialize () returned 0x0
Thread:
id = 117
os_tid = 0x430
Thread:
id = 118
os_tid = 0xc44
Thread:
id = 119
os_tid = 0x1294
Thread:
id = 141
os_tid = 0xe2c
[0235.866] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0235.866] RoInitialize () returned 0x1
[0235.866] RoUninitialize () returned 0x0
[0235.892] IIDFromString (in: lpsz="{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}", lpiid=0x4e0f5b4 | out: lpiid=0x4e0f5b4) returned 0x0
[0235.894] CoGetClassObject (in: rclsid=0x53badc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c0a54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x54dae8) returned 0x0
[0235.894] WbemDefPath:IUnknown:QueryInterface (in: This=0x54dae8, riid=0x6c0595e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002
[0235.894] WbemDefPath:IClassFactory:CreateInstance (in: This=0x54dae8, pUnkOuter=0x0, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x54d498) returned 0x0
[0235.895] WbemDefPath:IUnknown:Release (This=0x54dae8) returned 0x0
[0235.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d498, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x54d498) returned 0x0
[0235.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d498, riid=0x6c12fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002
[0235.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d498, riid=0x6c13056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002
[0235.895] WbemDefPath:IUnknown:AddRef (This=0x54d498) returned 0x3
[0235.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d498, riid=0x6c130208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002
[0235.895] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d498, riid=0x6c13015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002
[0235.896] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d498, riid=0x6c0040e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x547400) returned 0x0
[0235.896] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x547400, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
[0235.896] WbemDefPath:IUnknown:Release (This=0x547400) returned 0x3
[0235.896] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0
[0235.900] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0
[0235.900] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d498, riid=0x6c130448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002
[0235.900] WbemDefPath:IUnknown:Release (This=0x54d498) returned 0x2
[0235.900] WbemDefPath:IUnknown:Release (This=0x54d498) returned 0x1
[0235.998] SetEvent (hEvent=0x3c0) returned 1
[0236.010] CoGetClassObject (in: rclsid=0x53badc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c0a54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x54dbd8) returned 0x0
[0236.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x54dbd8, riid=0x6c0595e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002
[0236.011] WbemDefPath:IClassFactory:CreateInstance (in: This=0x54dbd8, pUnkOuter=0x0, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x54d428) returned 0x0
[0236.011] WbemDefPath:IUnknown:Release (This=0x54dbd8) returned 0x0
[0236.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d428, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x54d428) returned 0x0
[0236.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d428, riid=0x6c12fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002
[0236.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d428, riid=0x6c13056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002
[0236.011] WbemDefPath:IUnknown:AddRef (This=0x54d428) returned 0x3
[0236.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d428, riid=0x6c130208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002
[0236.011] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d428, riid=0x6c13015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002
[0236.012] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d428, riid=0x6c0040e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x5472e0) returned 0x0
[0236.012] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x5472e0, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
[0236.012] WbemDefPath:IUnknown:Release (This=0x5472e0) returned 0x3
[0236.012] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0
[0236.013] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0
[0236.013] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d428, riid=0x6c130448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002
[0236.013] WbemDefPath:IUnknown:Release (This=0x54d428) returned 0x2
[0236.013] WbemDefPath:IUnknown:Release (This=0x54d428) returned 0x1
[0236.013] SetEvent (hEvent=0x3f0) returned 1
[0236.015] CoGetClassObject (in: rclsid=0x53badc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c0a54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x54db68) returned 0x0
[0236.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x54db68, riid=0x6c0595e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002
[0236.016] WbemDefPath:IClassFactory:CreateInstance (in: This=0x54db68, pUnkOuter=0x0, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x54d268) returned 0x0
[0236.016] WbemDefPath:IUnknown:Release (This=0x54db68) returned 0x0
[0236.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d268, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x54d268) returned 0x0
[0236.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d268, riid=0x6c12fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002
[0236.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d268, riid=0x6c13056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002
[0236.016] WbemDefPath:IUnknown:AddRef (This=0x54d268) returned 0x3
[0236.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d268, riid=0x6c130208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002
[0236.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d268, riid=0x6c13015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002
[0236.016] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d268, riid=0x6c0040e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x547328) returned 0x0
[0236.016] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x547328, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
[0236.016] WbemDefPath:IUnknown:Release (This=0x547328) returned 0x3
[0236.016] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0
[0236.017] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0
[0236.017] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d268, riid=0x6c130448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002
[0236.017] WbemDefPath:IUnknown:Release (This=0x54d268) returned 0x2
[0236.017] WbemDefPath:IUnknown:Release (This=0x54d268) returned 0x1
[0236.017] SetEvent (hEvent=0x3f4) returned 1
[0238.404] CoGetClassObject (in: rclsid=0x53badc*(Data1=0xcf4cc405, Data2=0xe2c5, Data3=0x4ddd, Data4=([0]=0xb3, [1]=0xce, [2]=0x5e, [3]=0x75, [4]=0x82, [5]=0xd8, [6]=0xc9, [7]=0xfa)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c0a54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4e0f2c8 | out: ppv=0x4e0f2c8*=0x54dc78) returned 0x0
[0238.405] WbemDefPath:IUnknown:QueryInterface (in: This=0x54dc78, riid=0x6c0595e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4e0f4e0 | out: ppvObject=0x4e0f4e0*=0x0) returned 0x80004002
[0238.405] WbemDefPath:IClassFactory:CreateInstance (in: This=0x54dc78, pUnkOuter=0x0, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f4f4 | out: ppvObject=0x4e0f4f4*=0x54d578) returned 0x0
[0238.405] WbemDefPath:IUnknown:Release (This=0x54dc78) returned 0x0
[0238.405] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d578, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0f114 | out: ppvObject=0x4e0f114*=0x54d578) returned 0x0
[0238.405] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d578, riid=0x6c12fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4e0f0d0 | out: ppvObject=0x4e0f0d0*=0x0) returned 0x80004002
[0238.405] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d578, riid=0x6c13056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4e0ecc4 | out: ppvObject=0x4e0ecc4*=0x0) returned 0x80004002
[0238.406] WbemDefPath:IUnknown:AddRef (This=0x54d578) returned 0x3
[0238.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d578, riid=0x6c130208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4e0ea2c | out: ppvObject=0x4e0ea2c*=0x0) returned 0x80004002
[0238.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d578, riid=0x6c13015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4e0e9dc | out: ppvObject=0x4e0e9dc*=0x0) returned 0x80004002
[0238.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d578, riid=0x6c0040e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0e9e8 | out: ppvObject=0x4e0e9e8*=0x547640) returned 0x0
[0238.406] WbemDefPath:IMarshal:GetUnmarshalClass (in: This=0x547640, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4e0e9f0 | out: pCid=0x4e0e9f0*(Data1=0x33a, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
[0238.406] WbemDefPath:IUnknown:Release (This=0x547640) returned 0x3
[0238.406] CoGetContextToken (in: pToken=0x4e0ea48 | out: pToken=0x4e0ea48) returned 0x0
[0238.406] CoGetContextToken (in: pToken=0x4e0ee50 | out: pToken=0x4e0ee50) returned 0x0
[0238.406] WbemDefPath:IUnknown:QueryInterface (in: This=0x54d578, riid=0x6c130448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4e0eee0 | out: ppvObject=0x4e0eee0*=0x0) returned 0x80004002
[0238.406] WbemDefPath:IUnknown:Release (This=0x54d578) returned 0x2
[0238.406] WbemDefPath:IUnknown:Release (This=0x54d578) returned 0x1
[0238.406] SetEvent (hEvent=0x444) returned 1
Thread:
id = 142
os_tid = 0xf14
[0236.059] CoInitializeEx (pvReserved=0x0, dwCoInit=0x0) returned 0x0
[0236.059] RoInitialize () returned 0x1
[0236.059] RoUninitialize () returned 0x0
[0236.060] IIDFromString (in: lpsz="{4590F811-1D3A-11D0-891F-00AA004B2E24}", lpiid=0x4f4f7fc | out: lpiid=0x4f4f7fc) returned 0x0
[0236.061] CoGetClassObject (in: rclsid=0x53b5cc*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), dwClsContext=0x15, pvReserved=0x0, riid=0x6c0a54e0*(Data1=0x1, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x4f4f510 | out: ppv=0x4f4f510*=0x5478b0) returned 0x0
[0236.061] WbemLocator:IUnknown:QueryInterface (in: This=0x5478b0, riid=0x6c0595e0*(Data1=0xb196b28f, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4f4f728 | out: ppvObject=0x4f4f728*=0x0) returned 0x80004002
[0236.061] WbemLocator:IClassFactory:CreateInstance (in: This=0x5478b0, pUnkOuter=0x0, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f73c | out: ppvObject=0x4f4f73c*=0x54dc68) returned 0x0
[0236.061] WbemLocator:IUnknown:Release (This=0x5478b0) returned 0x0
[0236.061] WbemLocator:IUnknown:QueryInterface (in: This=0x54dc68, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f35c | out: ppvObject=0x4f4f35c*=0x54dc68) returned 0x0
[0236.062] WbemLocator:IUnknown:QueryInterface (in: This=0x54dc68, riid=0x6c12fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4f4f318 | out: ppvObject=0x4f4f318*=0x0) returned 0x80004002
[0236.062] WbemLocator:IUnknown:QueryInterface (in: This=0x54dc68, riid=0x6c13056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4f4ef0c | out: ppvObject=0x4f4ef0c*=0x0) returned 0x80004002
[0236.062] WbemLocator:IUnknown:AddRef (This=0x54dc68) returned 0x3
[0236.062] WbemLocator:IUnknown:QueryInterface (in: This=0x54dc68, riid=0x6c130208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4f4ec74 | out: ppvObject=0x4f4ec74*=0x0) returned 0x80004002
[0236.062] WbemLocator:IUnknown:QueryInterface (in: This=0x54dc68, riid=0x6c13015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4f4ec24 | out: ppvObject=0x4f4ec24*=0x0) returned 0x80004002
[0236.062] WbemLocator:IUnknown:QueryInterface (in: This=0x54dc68, riid=0x6c0040e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4ec30 | out: ppvObject=0x4f4ec30*=0x0) returned 0x80004002
[0236.062] CoGetContextToken (in: pToken=0x4f4ec90 | out: pToken=0x4f4ec90) returned 0x0
[0236.062] CoGetObjectContext (in: riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppv=0x54774c | out: ppv=0x54774c*=0x4f0128) returned 0x0
[0236.066] CoGetContextToken (in: pToken=0x4f4f098 | out: pToken=0x4f4f098) returned 0x0
[0236.066] WbemLocator:IUnknown:QueryInterface (in: This=0x54dc68, riid=0x6c130448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f128 | out: ppvObject=0x4f4f128*=0x0) returned 0x80004002
[0236.066] WbemLocator:IUnknown:Release (This=0x54dc68) returned 0x2
[0236.066] WbemLocator:IUnknown:Release (This=0x54dc68) returned 0x1
[0236.067] CoGetContextToken (in: pToken=0x4f4f708 | out: pToken=0x4f4f708) returned 0x0
[0236.067] CoGetContextToken (in: pToken=0x4f4f668 | out: pToken=0x4f4f668) returned 0x0
[0236.067] WbemLocator:IUnknown:QueryInterface (in: This=0x54dc68, riid=0x4f4f738*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppvObject=0x4f4f734 | out: ppvObject=0x4f4f734*=0x54dc68) returned 0x0
[0236.067] WbemLocator:IUnknown:AddRef (This=0x54dc68) returned 0x3
[0236.067] WbemLocator:IUnknown:Release (This=0x54dc68) returned 0x2
[0236.071] WbemDefPath:IWbemPath:GetNamespaceCount (in: This=0x54d268, puCount=0x4f4f8cc | out: puCount=0x4f4f8cc*=0x2) returned 0x0
[0236.071] WbemDefPath:IWbemPath:GetText (in: This=0x54d268, lFlags=8, puBuffLength=0x4f4f8c8*=0x0, pszText=0x0 | out: puBuffLength=0x4f4f8c8*=0xf, pszText=0x0) returned 0x0
[0236.071] WbemDefPath:IWbemPath:GetText (in: This=0x54d268, lFlags=8, puBuffLength=0x4f4f8c8*=0xf, pszText="00000000000000" | out: puBuffLength=0x4f4f8c8*=0xf, pszText="\\\\.\\root\\cimv2") returned 0x0
[0236.078] GetFullPathNameW (in: lpFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", nBufferLength=0x105, lpBuffer=0x4f4eb4c, lpFilePart=0x0 | out: lpBuffer="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\", lpFilePart=0x0) returned 0x2e
[0236.079] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll", cchWideChar=63, lpMultiByteStr=0x4f4f050, cbMultiByte=65, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll\x02ò\x18\x90fUøC\x87 «þkHóô\x04°ÈT", lpUsedDefaultChar=0x0) returned 63
[0236.079] LoadLibraryA (lpLibFileName="C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\\\wminet_utils.dll") returned 0x69430000
[0236.252] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ResetSecurity", cchWideChar=13, lpMultiByteStr=0x4f4f084, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ResetSecurity\x1a\x90fUøC\x87 «þkHóô\x04°ÈT", lpUsedDefaultChar=0x0) returned 13
[0236.252] GetProcAddress (hModule=0x69430000, lpProcName="ResetSecurity") returned 0x694326fe
[0236.259] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SetSecurity", cchWideChar=11, lpMultiByteStr=0x4f4f084, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SetSecurity\x02D\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 11
[0236.259] GetProcAddress (hModule=0x69430000, lpProcName="SetSecurity") returned 0x69432740
[0236.272] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServices", cchWideChar=18, lpMultiByteStr=0x4f4f080, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServices\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 18
[0236.272] GetProcAddress (hModule=0x69430000, lpProcName="BlessIWbemServices") returned 0x69431e89
[0236.332] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BlessIWbemServicesObject", cchWideChar=24, lpMultiByteStr=0x4f4f078, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BlessIWbemServicesObjectD\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 24
[0236.332] GetProcAddress (hModule=0x69430000, lpProcName="BlessIWbemServicesObject") returned 0x69431edb
[0236.393] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyHandle", cchWideChar=17, lpMultiByteStr=0x4f4f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyHandle\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 17
[0236.393] GetProcAddress (hModule=0x69430000, lpProcName="GetPropertyHandle") returned 0x694323d4
[0236.408] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="WritePropertyValue", cchWideChar=18, lpMultiByteStr=0x4f4f080, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="WritePropertyValue\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 18
[0236.408] GetProcAddress (hModule=0x69430000, lpProcName="WritePropertyValue") returned 0x69432837
[0236.424] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4f4f08c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 5
[0236.424] GetProcAddress (hModule=0x69430000, lpProcName="Clone") returned 0x69431f2d
[0236.471] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="VerifyClientKey", cchWideChar=15, lpMultiByteStr=0x4f4f080, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="VerifyClientKey\x02D\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 15
[0236.471] GetProcAddress (hModule=0x69430000, lpProcName="VerifyClientKey") returned 0x694327d4
[0236.477] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetQualifierSet", cchWideChar=15, lpMultiByteStr=0x4f4f080, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetQualifierSet\x02D\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 15
[0236.477] GetProcAddress (hModule=0x69430000, lpProcName="GetQualifierSet") returned 0x69432435
[0236.479] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Get", cchWideChar=3, lpMultiByteStr=0x4f4f08c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Get\x02D\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 3
[0236.479] GetProcAddress (hModule=0x69430000, lpProcName="Get") returned 0x694322f4
[0236.536] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Put", cchWideChar=3, lpMultiByteStr=0x4f4f08c, cbMultiByte=5, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Put\x02D\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 3
[0236.537] GetProcAddress (hModule=0x69430000, lpProcName="Put") returned 0x694324de
[0236.558] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Delete", cchWideChar=6, lpMultiByteStr=0x4f4f08c, cbMultiByte=8, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Delete\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 6
[0236.558] GetProcAddress (hModule=0x69430000, lpProcName="Delete") returned 0x69432151
[0236.570] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetNames", cchWideChar=8, lpMultiByteStr=0x4f4f088, cbMultiByte=10, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetNamesD\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 8
[0236.571] GetProcAddress (hModule=0x69430000, lpProcName="GetNames") returned 0x694323a2
[0236.644] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginEnumeration", cchWideChar=16, lpMultiByteStr=0x4f4f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginEnumerationD\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 16
[0236.644] GetProcAddress (hModule=0x69430000, lpProcName="BeginEnumeration") returned 0x69431e63
[0236.693] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Next", cchWideChar=4, lpMultiByteStr=0x4f4f08c, cbMultiByte=6, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextD\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 4
[0236.694] GetProcAddress (hModule=0x69430000, lpProcName="Next") returned 0x694324a3
[0236.712] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndEnumeration", cchWideChar=14, lpMultiByteStr=0x4f4f084, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndEnumeration\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 14
[0236.712] GetProcAddress (hModule=0x69430000, lpProcName="EndEnumeration") returned 0x694321e2
[0236.724] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyQualifierSet", cchWideChar=23, lpMultiByteStr=0x4f4f078, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyQualifierSet\x02D\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 23
[0236.725] GetProcAddress (hModule=0x69430000, lpProcName="GetPropertyQualifierSet") returned 0x6943241f
[0236.775] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="Clone", cchWideChar=5, lpMultiByteStr=0x4f4f08c, cbMultiByte=7, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Clone\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 5
[0236.776] GetProcAddress (hModule=0x69430000, lpProcName="Clone") returned 0x69431f2d
[0236.776] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetObjectText", cchWideChar=13, lpMultiByteStr=0x4f4f084, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetObjectText\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 13
[0236.776] GetProcAddress (hModule=0x69430000, lpProcName="GetObjectText") returned 0x694323be
[0236.790] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnDerivedClass", cchWideChar=17, lpMultiByteStr=0x4f4f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnDerivedClass\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 17
[0236.790] GetProcAddress (hModule=0x69430000, lpProcName="SpawnDerivedClass") returned 0x69432786
[0236.846] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="SpawnInstance", cchWideChar=13, lpMultiByteStr=0x4f4f084, cbMultiByte=15, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="SpawnInstance\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 13
[0236.847] GetProcAddress (hModule=0x69430000, lpProcName="SpawnInstance") returned 0x6943279c
[0236.848] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CompareTo", cchWideChar=9, lpMultiByteStr=0x4f4f088, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CompareTo\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 9
[0236.848] GetProcAddress (hModule=0x69430000, lpProcName="CompareTo") returned 0x69431fad
[0236.859] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetPropertyOrigin", cchWideChar=17, lpMultiByteStr=0x4f4f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetPropertyOrigin\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 17
[0236.859] GetProcAddress (hModule=0x69430000, lpProcName="GetPropertyOrigin") returned 0x69432409
[0236.876] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="InheritsFrom", cchWideChar=12, lpMultiByteStr=0x4f4f084, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="InheritsFromD\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 12
[0236.877] GetProcAddress (hModule=0x69430000, lpProcName="InheritsFrom") returned 0x69432448
[0236.878] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethod", cchWideChar=9, lpMultiByteStr=0x4f4f088, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethod\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 9
[0236.878] GetProcAddress (hModule=0x69430000, lpProcName="GetMethod") returned 0x6943235a
[0236.933] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutMethod", cchWideChar=9, lpMultiByteStr=0x4f4f088, cbMultiByte=11, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutMethod\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 9
[0236.934] GetProcAddress (hModule=0x69430000, lpProcName="PutMethod") returned 0x694325fa
[0236.949] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="DeleteMethod", cchWideChar=12, lpMultiByteStr=0x4f4f084, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="DeleteMethodD\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 12
[0236.949] GetProcAddress (hModule=0x69430000, lpProcName="DeleteMethod") returned 0x69432164
[0236.951] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="BeginMethodEnumeration", cchWideChar=22, lpMultiByteStr=0x4f4f07c, cbMultiByte=24, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="BeginMethodEnumeration\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 22
[0236.951] GetProcAddress (hModule=0x69430000, lpProcName="BeginMethodEnumeration") returned 0x69431e76
[0236.990] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="NextMethod", cchWideChar=10, lpMultiByteStr=0x4f4f088, cbMultiByte=12, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="NextMethod\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 10
[0236.991] GetProcAddress (hModule=0x69430000, lpProcName="NextMethod") returned 0x694324c2
[0237.007] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="EndMethodEnumeration", cchWideChar=20, lpMultiByteStr=0x4f4f07c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="EndMethodEnumerationD\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 20
[0237.007] GetProcAddress (hModule=0x69430000, lpProcName="EndMethodEnumeration") returned 0x694321f2
[0237.009] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodQualifierSet", cchWideChar=21, lpMultiByteStr=0x4f4f07c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodQualifierSet\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 21
[0237.009] GetProcAddress (hModule=0x69430000, lpProcName="GetMethodQualifierSet") returned 0x6943238c
[0237.010] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetMethodOrigin", cchWideChar=15, lpMultiByteStr=0x4f4f080, cbMultiByte=17, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetMethodOrigin\x02D\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 15
[0237.011] GetProcAddress (hModule=0x69430000, lpProcName="GetMethodOrigin") returned 0x69432376
[0237.012] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Get", cchWideChar=16, lpMultiByteStr=0x4f4f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetD\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 16
[0237.012] GetProcAddress (hModule=0x69430000, lpProcName="QualifierSet_Get") returned 0x6943264c
[0237.116] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Put", cchWideChar=16, lpMultiByteStr=0x4f4f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_PutD\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 16
[0237.116] GetProcAddress (hModule=0x69430000, lpProcName="QualifierSet_Put") returned 0x6943269a
[0237.133] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Delete", cchWideChar=19, lpMultiByteStr=0x4f4f07c, cbMultiByte=21, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Delete\x02D\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 19
[0237.133] GetProcAddress (hModule=0x69430000, lpProcName="QualifierSet_Delete") returned 0x69432629
[0237.134] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_GetNames", cchWideChar=21, lpMultiByteStr=0x4f4f07c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_GetNames\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 21
[0237.134] GetProcAddress (hModule=0x69430000, lpProcName="QualifierSet_GetNames") returned 0x69432668
[0237.188] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_BeginEnumeration", cchWideChar=29, lpMultiByteStr=0x4f4f074, cbMultiByte=31, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_BeginEnumeration\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 29
[0237.189] GetProcAddress (hModule=0x69430000, lpProcName="QualifierSet_BeginEnumeration") returned 0x69432616
[0237.190] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_Next", cchWideChar=17, lpMultiByteStr=0x4f4f080, cbMultiByte=19, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_Next\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 17
[0237.190] GetProcAddress (hModule=0x69430000, lpProcName="QualifierSet_Next") returned 0x6943267e
[0237.203] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="QualifierSet_EndEnumeration", cchWideChar=27, lpMultiByteStr=0x4f4f074, cbMultiByte=29, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="QualifierSet_EndEnumeration\x02D\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 27
[0237.203] GetProcAddress (hModule=0x69430000, lpProcName="QualifierSet_EndEnumeration") returned 0x6943263c
[0237.205] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetCurrentApartmentType", cchWideChar=23, lpMultiByteStr=0x4f4f078, cbMultiByte=25, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetCurrentApartmentType\x02D\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 23
[0237.205] GetProcAddress (hModule=0x69430000, lpProcName="GetCurrentApartmentType") returned 0x69432435
[0237.214] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="GetDemultiplexedStub", cchWideChar=20, lpMultiByteStr=0x4f4f07c, cbMultiByte=22, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="GetDemultiplexedStubD\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 20
[0237.214] GetProcAddress (hModule=0x69430000, lpProcName="GetDemultiplexedStub") returned 0x69432313
[0237.266] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateInstanceEnumWmi", cchWideChar=21, lpMultiByteStr=0x4f4f07c, cbMultiByte=23, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateInstanceEnumWmi\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 21
[0237.266] GetProcAddress (hModule=0x69430000, lpProcName="CreateInstanceEnumWmi") returned 0x694320db
[0237.347] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CreateClassEnumWmi", cchWideChar=18, lpMultiByteStr=0x4f4f080, cbMultiByte=20, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CreateClassEnumWmi\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 18
[0237.347] GetProcAddress (hModule=0x69430000, lpProcName="CreateClassEnumWmi") returned 0x69432065
[0237.349] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecQueryWmi", cchWideChar=12, lpMultiByteStr=0x4f4f084, cbMultiByte=14, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecQueryWmiD\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 12
[0237.350] GetProcAddress (hModule=0x69430000, lpProcName="ExecQueryWmi") returned 0x6943227b
[0237.489] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ExecNotificationQueryWmi", cchWideChar=24, lpMultiByteStr=0x4f4f078, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ExecNotificationQueryWmiD\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 24
[0237.490] GetProcAddress (hModule=0x69430000, lpProcName="ExecNotificationQueryWmi") returned 0x69432202
[0237.492] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutInstanceWmi", cchWideChar=14, lpMultiByteStr=0x4f4f084, cbMultiByte=16, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutInstanceWmi\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 14
[0237.492] GetProcAddress (hModule=0x69430000, lpProcName="PutInstanceWmi") returned 0x6943257a
[0237.575] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="PutClassWmi", cchWideChar=11, lpMultiByteStr=0x4f4f084, cbMultiByte=13, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="PutClassWmi\x02D\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 11
[0237.575] GetProcAddress (hModule=0x69430000, lpProcName="PutClassWmi") returned 0x694324fa
[0237.577] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="CloneEnumWbemClassObject", cchWideChar=24, lpMultiByteStr=0x4f4f078, cbMultiByte=26, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="CloneEnumWbemClassObjectD\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 24
[0237.578] GetProcAddress (hModule=0x69430000, lpProcName="CloneEnumWbemClassObject") returned 0x69431f40
[0237.650] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ConnectServerWmi", cchWideChar=16, lpMultiByteStr=0x4f4f080, cbMultiByte=18, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ConnectServerWmiD\x1a\x90fUøC\x87 «þkHóô\x04", lpUsedDefaultChar=0x0) returned 16
[0237.650] GetProcAddress (hModule=0x69430000, lpProcName="ConnectServerWmi") returned 0x69431fc3
[0237.773] CoCreateInstance (in: rclsid=0x69431284*(Data1=0x4590f811, Data2=0x1d3a, Data3=0x11d0, Data4=([0]=0x89, [1]=0x1f, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), pUnkOuter=0x0, dwClsContext=0x1, riid=0x694312e4*(Data1=0xdc12a687, Data2=0x737f, Data3=0x11cf, Data4=([0]=0x88, [1]=0x4d, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x4b, [6]=0x2e, [7]=0x24)), ppv=0x4f4f7a4 | out: ppv=0x4f4f7a4*=0x54dc48) returned 0x0
[0237.778] WbemLocator:IWbemLocator:ConnectServer (in: This=0x54dc48, strNetworkResource="\\\\.\\root\\cimv2", strUser=0x0, strPassword=0x0, strLocale="", lSecurityFlags=128, strAuthority="", pCtx=0x0, ppNamespace=0x4f4f838 | out: ppNamespace=0x4f4f838*=0x52e868) returned 0x0
[0238.055] WbemLocator:IUnknown:QueryInterface (in: This=0x52e868, riid=0x69431104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f6d4 | out: ppvObject=0x4f4f6d4*=0x5182cc) returned 0x0
[0238.055] WbemLocator:IClientSecurity:QueryBlanket (in: This=0x5182cc, pProxy=0x52e868, pAuthnSvc=0x4f4f724, pAuthzSvc=0x4f4f720, pServerPrincName=0x4f4f718, pAuthnLevel=0x4f4f71c, pImpLevel=0x4f4f70c, pAuthInfo=0x4f4f710, pCapabilites=0x4f4f714 | out: pAuthnSvc=0x4f4f724*=0xa, pAuthzSvc=0x4f4f720*=0x0, pServerPrincName=0x4f4f718, pAuthnLevel=0x4f4f71c*=0x6, pImpLevel=0x4f4f70c*=0x2, pAuthInfo=0x4f4f710, pCapabilites=0x4f4f714*=0x1) returned 0x0
[0238.055] WbemLocator:IUnknown:Release (This=0x5182cc) returned 0x1
[0238.056] WbemLocator:IUnknown:QueryInterface (in: This=0x52e868, riid=0x694310f4*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f6c8 | out: ppvObject=0x4f4f6c8*=0x5182f0) returned 0x0
[0238.056] WbemLocator:IUnknown:QueryInterface (in: This=0x52e868, riid=0x69431104*(Data1=0x13d, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f6c4 | out: ppvObject=0x4f4f6c4*=0x5182cc) returned 0x0
[0238.056] WbemLocator:IClientSecurity:SetBlanket (This=0x5182cc, pProxy=0x52e868, dwAuthnSvc=0xa, dwAuthzSvc=0x0, pServerPrincName=0x0, dwAuthnLevel=0x6, dwImpLevel=0x3, pAuthInfo=0x0, dwCapabilities=0x20) returned 0x0
[0238.057] WbemLocator:IUnknown:Release (This=0x5182cc) returned 0x2
[0238.057] WbemLocator:IUnknown:Release (This=0x5182f0) returned 0x1
[0238.057] CoTaskMemFree (pv=0x5538b0)
[0238.057] WbemLocator:IUnknown:Release (This=0x54dc48) returned 0x0
[0238.058] WbemLocator:IUnknown:QueryInterface (in: This=0x52e868, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f2c4 | out: ppvObject=0x4f4f2c4*=0x5182f0) returned 0x0
[0238.072] WbemLocator:IUnknown:QueryInterface (in: This=0x5182f0, riid=0x6c12fdcc*(Data1=0xc3fcc19e, Data2=0xa970, Data3=0x11d2, Data4=([0]=0x8b, [1]=0x5a, [2]=0x0, [3]=0xa0, [4]=0xc9, [5]=0xb7, [6]=0xc9, [7]=0xc4)), ppvObject=0x4f4f280 | out: ppvObject=0x4f4f280*=0x0) returned 0x80004002
[0238.077] WbemLocator:IUnknown:QueryInterface (in: This=0x5182f0, riid=0x6c12fb20*(Data1=0xb196b283, Data2=0xbab4, Data3=0x101a, Data4=([0]=0xb6, [1]=0x9c, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x34, [6]=0x1d, [7]=0x7)), ppvObject=0x4f4f09c | out: ppvObject=0x4f4f09c*=0x0) returned 0x80004002
[0238.078] WbemLocator:IUnknown:QueryInterface (in: This=0x52e868, riid=0x6c13056c*(Data1=0xaf86e2e0, Data2=0xb12d, Data3=0x4c6a, Data4=([0]=0x9c, [1]=0x5a, [2]=0xd7, [3]=0xaa, [4]=0x65, [5]=0x10, [6]=0x1e, [7]=0x90)), ppvObject=0x4f4ee74 | out: ppvObject=0x4f4ee74*=0x0) returned 0x80004002
[0238.078] WbemLocator:IUnknown:AddRef (This=0x5182f0) returned 0x3
[0238.078] WbemLocator:IUnknown:QueryInterface (in: This=0x5182f0, riid=0x6c130208*(Data1=0xecc8691b, Data2=0xc1db, Data3=0x4dc0, Data4=([0]=0x85, [1]=0x5e, [2]=0x65, [3]=0xf6, [4]=0xc5, [5]=0x51, [6]=0xaf, [7]=0x49)), ppvObject=0x4f4ebdc | out: ppvObject=0x4f4ebdc*=0x0) returned 0x80004002
[0238.078] WbemLocator:IUnknown:QueryInterface (in: This=0x5182f0, riid=0x6c13015c*(Data1=0x94ea2b94, Data2=0xe9cc, Data3=0x49e0, Data4=([0]=0xc0, [1]=0xff, [2]=0xee, [3]=0x64, [4]=0xca, [5]=0x8f, [6]=0x5b, [7]=0x90)), ppvObject=0x4f4eb8c | out: ppvObject=0x4f4eb8c*=0x0) returned 0x80004002
[0238.078] WbemLocator:IUnknown:QueryInterface (in: This=0x5182f0, riid=0x6c0040e8*(Data1=0x3, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4eb98 | out: ppvObject=0x4f4eb98*=0x51824c) returned 0x0
[0238.079] WbemLocator:IMarshal:GetUnmarshalClass (in: This=0x51824c, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pv=0x0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0, pCid=0x4f4eba0 | out: pCid=0x4f4eba0*(Data1=0x17, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46))) returned 0x0
[0238.079] WbemLocator:IUnknown:Release (This=0x51824c) returned 0x3
[0238.079] CoGetContextToken (in: pToken=0x4f4ebf8 | out: pToken=0x4f4ebf8) returned 0x0
[0238.079] CoGetContextToken (in: pToken=0x4f4f000 | out: pToken=0x4f4f000) returned 0x0
[0238.079] WbemLocator:IUnknown:QueryInterface (in: This=0x5182f0, riid=0x6c130448*(Data1=0x144, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), ppvObject=0x4f4f090 | out: ppvObject=0x4f4f090*=0x5182d4) returned 0x0
[0238.080] WbemLocator:IRpcOptions:Query (in: This=0x5182d4, pPrx=0x5182f0, dwProperty=2, pdwValue=0x4f4f0b8 | out: pdwValue=0x4f4f0b8) returned 0x80004002
[0238.081] WbemLocator:IUnknown:Release (This=0x5182d4) returned 0x3
[0238.081] WbemLocator:IUnknown:Release (This=0x5182f0) returned 0x2
[0238.081] CoGetContextToken (in: pToken=0x4f4f5d8 | out: pToken=0x4f4f5d8) returned 0x0
[0238.139] CoGetContextToken (in: pToken=0x4f4f538 | out: pToken=0x4f4f538) returned 0x0
[0238.139] WbemLocator:IUnknown:QueryInterface (in: This=0x5182f0, riid=0x4f4f608*(Data1=0x9556dc99, Data2=0x828c, Data3=0x11cf, Data4=([0]=0xa3, [1]=0x7e, [2]=0x0, [3]=0xaa, [4]=0x0, [5]=0x32, [6]=0x40, [7]=0xc7)), ppvObject=0x4f4f604 | out: ppvObject=0x4f4f604*=0x52e868) returned 0x0
[0238.139] WbemLocator:IUnknown:AddRef (This=0x52e868) returned 0x4
[0238.139] WbemLocator:IUnknown:Release (This=0x52e868) returned 0x3
[0238.139] WbemLocator:IUnknown:Release (This=0x52e868) returned 0x2
[0238.193] SysStringLen (param_1=0x0) returned 0x0
[0238.194] CoUninitialize ()
Thread:
id = 143
os_tid = 0x10b0
[0238.286] CoGetContextToken (in: pToken=0x4f4f26c | out: pToken=0x4f4f26c) returned 0x0
[0238.286] CoGetContextToken (in: pToken=0x4f4f25c | out: pToken=0x4f4f25c) returned 0x0
[0238.286] CoGetMarshalSizeMax (in: pulSize=0x4f4f218, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5182f0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0 | out: pulSize=0x4f4f218) returned 0x0
[0238.294] CoMarshalInterface (pStm=0x52afb0, riid=0x6bff6c6c*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0xc0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x46)), pUnk=0x5182f0, dwDestContext=0x3, pvDestContext=0x0, mshlflags=0x0) returned 0x0
Process:
id = "8"
image_name = "wmiprvse.exe"
filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe"
page_root = "0x7bbe3000"
os_pid = "0x134c"
os_integrity_level = "0x4000"
os_privileges = "0x60800000"
monitor_reason = "rpc_server"
parent_id = "6"
os_parent_pid = "0x274"
cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -secured -Embedding"
cur_dir = "C:\\Windows\\system32\\"
os_username = "NT AUTHORITY\\Network Service"
bitness = "32"
os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "WMI (Network Service)" [0xf], "NT AUTHORITY\\Logon Session 00000000:000641ad" [0xc000000f]
Region:
id = 1683
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 1684
start_va = 0x20000
end_va = 0x26fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 1685
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 1686
start_va = 0x50000
end_va = 0xcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 1687
start_va = 0xd0000
end_va = 0xd3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 1688
start_va = 0xe0000
end_va = 0xe0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 1689
start_va = 0xf0000
end_va = 0xf1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000f0000"
filename = ""
Region:
id = 1690
start_va = 0x100000
end_va = 0x1bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1691
start_va = 0x1c0000
end_va = 0x1c6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 1692
start_va = 0x1d0000
end_va = 0x1d0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001d0000"
filename = ""
Region:
id = 1693
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001e0000"
filename = ""
Region:
id = 1694
start_va = 0x1f0000
end_va = 0x1f1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001f0000"
filename = ""
Region:
id = 1695
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 1696
start_va = 0x480000
end_va = 0x480fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000480000"
filename = ""
Region:
id = 1697
start_va = 0x490000
end_va = 0x494fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "user32.dll.mui"
filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui")
Region:
id = 1698
start_va = 0x4a0000
end_va = 0x4a0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004a0000"
filename = ""
Region:
id = 1699
start_va = 0x4b0000
end_va = 0x4b0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004b0000"
filename = ""
Region:
id = 1700
start_va = 0x4c0000
end_va = 0x4c0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004c0000"
filename = ""
Region:
id = 1701
start_va = 0x4e0000
end_va = 0x4e2fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "security.dll"
filename = "\\Windows\\System32\\security.dll" (normalized: "c:\\windows\\system32\\security.dll")
Region:
id = 1702
start_va = 0x510000
end_va = 0x512fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "cimwin32.dll.mui"
filename = "\\Windows\\System32\\wbem\\en-US\\cimwin32.dll.mui" (normalized: "c:\\windows\\system32\\wbem\\en-us\\cimwin32.dll.mui")
Region:
id = 1703
start_va = 0x520000
end_va = 0x61ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000520000"
filename = ""
Region:
id = 1704
start_va = 0x620000
end_va = 0x7a7fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000620000"
filename = ""
Region:
id = 1705
start_va = 0x7b0000
end_va = 0x7bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000007b0000"
filename = ""
Region:
id = 1706
start_va = 0x7c0000
end_va = 0xaf6fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1707
start_va = 0xb00000
end_va = 0xc80fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000b00000"
filename = ""
Region:
id = 1708
start_va = 0xc90000
end_va = 0xd4ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000c90000"
filename = ""
Region:
id = 1709
start_va = 0xd50000
end_va = 0xdcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000d50000"
filename = ""
Region:
id = 1710
start_va = 0xdd0000
end_va = 0xecffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000dd0000"
filename = ""
Region:
id = 1711
start_va = 0xed0000
end_va = 0xf4ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000ed0000"
filename = ""
Region:
id = 1712
start_va = 0xf50000
end_va = 0xfcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f50000"
filename = ""
Region:
id = 1713
start_va = 0xfd0000
end_va = 0x104ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000fd0000"
filename = ""
Region:
id = 1714
start_va = 0x1050000
end_va = 0x10cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001050000"
filename = ""
Region:
id = 1715
start_va = 0x10d0000
end_va = 0x114ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000010d0000"
filename = ""
Region:
id = 1716
start_va = 0x1150000
end_va = 0x11cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001150000"
filename = ""
Region:
id = 1717
start_va = 0x11d0000
end_va = 0x124ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000011d0000"
filename = ""
Region:
id = 1718
start_va = 0x1250000
end_va = 0x134ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001250000"
filename = ""
Region:
id = 1719
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 1720
start_va = 0x180000000
end_va = 0x180002fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "wmi.dll"
filename = "\\Windows\\System32\\wmi.dll" (normalized: "c:\\windows\\system32\\wmi.dll")
Region:
id = 1721
start_va = 0x7df5ffec0000
end_va = 0x7df5fffbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffec0000"
filename = ""
Region:
id = 1722
start_va = 0x7df5fffc0000
end_va = 0x7df5fffe2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5fffc0000"
filename = ""
Region:
id = 1723
start_va = 0x7df5ffff0000
end_va = 0x7ff5fffeffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffff0000"
filename = ""
Region:
id = 1724
start_va = 0x7ff748430000
end_va = 0x7ff7484affff
monitored = 0
entry_point = 0x7ff748445f50
region_type = mapped_file
name = "wmiprvse.exe"
filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe")
Region:
id = 1725
start_va = 0x7ff865730000
end_va = 0x7ff8658fefff
monitored = 1
entry_point = 0x7ff865757df0
region_type = mapped_file
name = "cimwin32.dll"
filename = "\\Windows\\System32\\wbem\\cimwin32.dll" (normalized: "c:\\windows\\system32\\wbem\\cimwin32.dll")
Region:
id = 1726
start_va = 0x7ff8702c0000
end_va = 0x7ff8702d5fff
monitored = 0
entry_point = 0x7ff8702c55e0
region_type = mapped_file
name = "ncobjapi.dll"
filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll")
Region:
id = 1727
start_va = 0x7ff870430000
end_va = 0x7ff870454fff
monitored = 0
entry_point = 0x7ff870439900
region_type = mapped_file
name = "wmiutils.dll"
filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll")
Region:
id = 1728
start_va = 0x7ff870460000
end_va = 0x7ff870473fff
monitored = 0
entry_point = 0x7ff870461800
region_type = mapped_file
name = "wbemsvc.dll"
filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")
Region:
id = 1729
start_va = 0x7ff870480000
end_va = 0x7ff870575fff
monitored = 0
entry_point = 0x7ff8704b9590
region_type = mapped_file
name = "fastprox.dll"
filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")
Region:
id = 1730
start_va = 0x7ff870890000
end_va = 0x7ff8708a0fff
monitored = 0
entry_point = 0x7ff870892fc0
region_type = mapped_file
name = "wbemprox.dll"
filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")
Region:
id = 1731
start_va = 0x7ff8715e0000
end_va = 0x7ff8715edfff
monitored = 0
entry_point = 0x7ff8715e1da0
region_type = mapped_file
name = "winbrand.dll"
filename = "\\Windows\\System32\\winbrand.dll" (normalized: "c:\\windows\\system32\\winbrand.dll")
Region:
id = 1732
start_va = 0x7ff872310000
end_va = 0x7ff87238efff
monitored = 1
entry_point = 0x7ff872327110
region_type = mapped_file
name = "wbemcomn.dll"
filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")
Region:
id = 1733
start_va = 0x7ff872470000
end_va = 0x7ff87247bfff
monitored = 0
entry_point = 0x7ff8724735c0
region_type = mapped_file
name = "secur32.dll"
filename = "\\Windows\\System32\\secur32.dll" (normalized: "c:\\windows\\system32\\secur32.dll")
Region:
id = 1734
start_va = 0x7ff874750000
end_va = 0x7ff874775fff
monitored = 0
entry_point = 0x7ff874751cf0
region_type = mapped_file
name = "srvcli.dll"
filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")
Region:
id = 1735
start_va = 0x7ff877c40000
end_va = 0x7ff877c53fff
monitored = 0
entry_point = 0x7ff877c41310
region_type = mapped_file
name = "browcli.dll"
filename = "\\Windows\\System32\\browcli.dll" (normalized: "c:\\windows\\system32\\browcli.dll")
Region:
id = 1736
start_va = 0x7ff878a90000
end_va = 0x7ff878a9afff
monitored = 0
entry_point = 0x7ff878a912b0
region_type = mapped_file
name = "schedcli.dll"
filename = "\\Windows\\System32\\schedcli.dll" (normalized: "c:\\windows\\system32\\schedcli.dll")
Region:
id = 1737
start_va = 0x7ff879720000
end_va = 0x7ff879731fff
monitored = 0
entry_point = 0x7ff879723580
region_type = mapped_file
name = "cscapi.dll"
filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")
Region:
id = 1738
start_va = 0x7ff87aa90000
end_va = 0x7ff87aaa5fff
monitored = 0
entry_point = 0x7ff87aa91b60
region_type = mapped_file
name = "wkscli.dll"
filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")
Region:
id = 1739
start_va = 0x7ff87abd0000
end_va = 0x7ff87ac1dfff
monitored = 0
entry_point = 0x7ff87abe1ce0
region_type = mapped_file
name = "framedynos.dll"
filename = "\\Windows\\System32\\framedynos.dll" (normalized: "c:\\windows\\system32\\framedynos.dll")
Region:
id = 1740
start_va = 0x7ff87b160000
end_va = 0x7ff87b178fff
monitored = 0
entry_point = 0x7ff87b164520
region_type = mapped_file
name = "samcli.dll"
filename = "\\Windows\\System32\\samcli.dll" (normalized: "c:\\windows\\system32\\samcli.dll")
Region:
id = 1741
start_va = 0x7ff87b6f0000
end_va = 0x7ff87b700fff
monitored = 0
entry_point = 0x7ff87b6f3320
region_type = mapped_file
name = "wmiclnt.dll"
filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll")
Region:
id = 1742
start_va = 0x7ff87d720000
end_va = 0x7ff87d75dfff
monitored = 0
entry_point = 0x7ff87d72a050
region_type = mapped_file
name = "logoncli.dll"
filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll")
Region:
id = 1743
start_va = 0x7ff87e420000
end_va = 0x7ff87e429fff
monitored = 0
entry_point = 0x7ff87e421660
region_type = mapped_file
name = "dsrole.dll"
filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")
Region:
id = 1744
start_va = 0x7ff87fad0000
end_va = 0x7ff87fae2fff
monitored = 0
entry_point = 0x7ff87fad2760
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")
Region:
id = 1745
start_va = 0x7ff87fd00000
end_va = 0x7ff87fd26fff
monitored = 0
entry_point = 0x7ff87fd07940
region_type = mapped_file
name = "devobj.dll"
filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")
Region:
id = 1746
start_va = 0x7ff8806f0000
end_va = 0x7ff8806fbfff
monitored = 0
entry_point = 0x7ff8806f27e0
region_type = mapped_file
name = "netutils.dll"
filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")
Region:
id = 1747
start_va = 0x7ff880830000
end_va = 0x7ff8808a9fff
monitored = 0
entry_point = 0x7ff880851a50
region_type = mapped_file
name = "schannel.dll"
filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll")
Region:
id = 1748
start_va = 0x7ff880f60000
end_va = 0x7ff880f8cfff
monitored = 0
entry_point = 0x7ff880f79d40
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 1749
start_va = 0x7ff8810f0000
end_va = 0x7ff881145fff
monitored = 0
entry_point = 0x7ff881100bf0
region_type = mapped_file
name = "winsta.dll"
filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")
Region:
id = 1750
start_va = 0x7ff881170000
end_va = 0x7ff881198fff
monitored = 0
entry_point = 0x7ff881184530
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 1751
start_va = 0x7ff8812e0000
end_va = 0x7ff88132afff
monitored = 0
entry_point = 0x7ff8812e35f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 1752
start_va = 0x7ff881330000
end_va = 0x7ff88133efff
monitored = 0
entry_point = 0x7ff881333210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 1753
start_va = 0x7ff881360000
end_va = 0x7ff88136ffff
monitored = 0
entry_point = 0x7ff8813656e0
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 1754
start_va = 0x7ff881370000
end_va = 0x7ff8813b2fff
monitored = 0
entry_point = 0x7ff881384b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 1755
start_va = 0x7ff881450000
end_va = 0x7ff881616fff
monitored = 0
entry_point = 0x7ff8814adb80
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 1756
start_va = 0x7ff881d30000
end_va = 0x7ff881d46fff
monitored = 0
entry_point = 0x7ff881d31390
region_type = mapped_file
name = "netapi32.dll"
filename = "\\Windows\\System32\\netapi32.dll" (normalized: "c:\\windows\\system32\\netapi32.dll")
Region:
id = 1757
start_va = 0x7ff881d50000
end_va = 0x7ff881db9fff
monitored = 0
entry_point = 0x7ff881d86d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 1758
start_va = 0x7ff881ed0000
end_va = 0x7ff8820b7fff
monitored = 0
entry_point = 0x7ff881efba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 1759
start_va = 0x7ff8820c0000
end_va = 0x7ff882215fff
monitored = 0
entry_point = 0x7ff8820ca8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 1760
start_va = 0x7ff882220000
end_va = 0x7ff8822bcfff
monitored = 0
entry_point = 0x7ff8822278a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 1761
start_va = 0x7ff8822c0000
end_va = 0x7ff88253cfff
monitored = 0
entry_point = 0x7ff882394970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 1762
start_va = 0x7ff882550000
end_va = 0x7ff8825aafff
monitored = 0
entry_point = 0x7ff8825638b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 1763
start_va = 0x7ff883b80000
end_va = 0x7ff883beafff
monitored = 0
entry_point = 0x7ff883b990c0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 1764
start_va = 0x7ff883bf0000
end_va = 0x7ff883d0bfff
monitored = 0
entry_point = 0x7ff883c302b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 1765
start_va = 0x7ff8841b0000
end_va = 0x7ff884256fff
monitored = 0
entry_point = 0x7ff8841bb4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 1766
start_va = 0x7ff884410000
end_va = 0x7ff8844d0fff
monitored = 0
entry_point = 0x7ff884430da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 1767
start_va = 0x7ff884920000
end_va = 0x7ff8849c6fff
monitored = 0
entry_point = 0x7ff8849358d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 1768
start_va = 0x7ff884a10000
end_va = 0x7ff884b95fff
monitored = 0
entry_point = 0x7ff884a5ffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 1769
start_va = 0x7ff884c10000
end_va = 0x7ff884cbcfff
monitored = 0
entry_point = 0x7ff884c281a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 1770
start_va = 0x7ff884cc0000
end_va = 0x7ff884e80fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 1773
start_va = 0x400000
end_va = 0x402fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000400000"
filename = ""
Region:
id = 1824
start_va = 0x400000
end_va = 0x401fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000400000"
filename = ""
Region:
id = 1825
start_va = 0x410000
end_va = 0x414fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000410000"
filename = ""
Region:
id = 1826
start_va = 0x1350000
end_va = 0x144ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001350000"
filename = ""
Region:
id = 1827
start_va = 0x410000
end_va = 0x425fff
monitored = 0
entry_point = 0x420420
region_type = mapped_file
name = "synth3dvsc.sys"
filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys")
Region:
id = 1828
start_va = 0x430000
end_va = 0x432fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "synth3dvsc.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui")
Region:
id = 1829
start_va = 0x410000
end_va = 0x425fff
monitored = 0
entry_point = 0x420420
region_type = mapped_file
name = "synth3dvsc.sys"
filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys")
Region:
id = 1830
start_va = 0x430000
end_va = 0x432fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "synth3dvsc.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui")
Region:
id = 1831
start_va = 0x410000
end_va = 0x425fff
monitored = 0
entry_point = 0x420420
region_type = mapped_file
name = "synth3dvsc.sys"
filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys")
Region:
id = 1832
start_va = 0x430000
end_va = 0x432fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "synth3dvsc.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui")
Region:
id = 1833
start_va = 0x410000
end_va = 0x425fff
monitored = 0
entry_point = 0x420420
region_type = mapped_file
name = "synth3dvsc.sys"
filename = "\\Windows\\System32\\drivers\\Synth3dVsc.sys" (normalized: "c:\\windows\\system32\\drivers\\synth3dvsc.sys")
Region:
id = 1834
start_va = 0x430000
end_va = 0x432fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "synth3dvsc.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\synth3dvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\synth3dvsc.sys.mui")
Region:
id = 1835
start_va = 0x410000
end_va = 0x429fff
monitored = 1
entry_point = 0x411190
region_type = mapped_file
name = "workflowservicehostperformancecounters.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll")
Region:
id = 1836
start_va = 0x430000
end_va = 0x435fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "workflowservicehostperformancecounters.dll.mui"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui")
Region:
id = 1837
start_va = 0x410000
end_va = 0x429fff
monitored = 1
entry_point = 0x411190
region_type = mapped_file
name = "workflowservicehostperformancecounters.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WorkflowServiceHostPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\workflowservicehostperformancecounters.dll")
Region:
id = 1838
start_va = 0x430000
end_va = 0x435fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "workflowservicehostperformancecounters.dll.mui"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\WorkflowServiceHostPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\workflowservicehostperformancecounters.dll.mui")
Region:
id = 1839
start_va = 0x410000
end_va = 0x43afff
monitored = 0
entry_point = 0x42d000
region_type = mapped_file
name = "pacer.sys"
filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys")
Region:
id = 1840
start_va = 0x440000
end_va = 0x444fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "pacer.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui")
Region:
id = 1841
start_va = 0x1510000
end_va = 0x190afff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001510000"
filename = ""
Region:
id = 1842
start_va = 0x410000
end_va = 0x43afff
monitored = 0
entry_point = 0x42d000
region_type = mapped_file
name = "pacer.sys"
filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys")
Region:
id = 1843
start_va = 0x440000
end_va = 0x444fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "pacer.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui")
Region:
id = 1844
start_va = 0x410000
end_va = 0x43afff
monitored = 0
entry_point = 0x42d000
region_type = mapped_file
name = "pacer.sys"
filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys")
Region:
id = 1845
start_va = 0x440000
end_va = 0x444fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "pacer.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui")
Region:
id = 1846
start_va = 0x410000
end_va = 0x43afff
monitored = 0
entry_point = 0x42d000
region_type = mapped_file
name = "pacer.sys"
filename = "\\Windows\\System32\\drivers\\pacer.sys" (normalized: "c:\\windows\\system32\\drivers\\pacer.sys")
Region:
id = 1847
start_va = 0x440000
end_va = 0x444fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "pacer.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\pacer.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\pacer.sys.mui")
Region:
id = 1848
start_va = 0x410000
end_va = 0x438fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "fxsresm.dll.mui"
filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui")
Region:
id = 1849
start_va = 0x1910000
end_va = 0x19f3fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "fxsresm.dll"
filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll")
Region:
id = 1850
start_va = 0x410000
end_va = 0x438fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "fxsresm.dll.mui"
filename = "\\Windows\\System32\\en-US\\FXSRESM.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\fxsresm.dll.mui")
Region:
id = 1851
start_va = 0x1910000
end_va = 0x19f3fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "fxsresm.dll"
filename = "\\Windows\\System32\\FXSRESM.dll" (normalized: "c:\\windows\\system32\\fxsresm.dll")
Region:
id = 1852
start_va = 0x410000
end_va = 0x415fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "afd.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui")
Region:
id = 1853
start_va = 0x1450000
end_va = 0x14e2fff
monitored = 0
entry_point = 0x14c9000
region_type = mapped_file
name = "afd.sys"
filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys")
Region:
id = 1854
start_va = 0x410000
end_va = 0x415fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "afd.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\afd.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\afd.sys.mui")
Region:
id = 1855
start_va = 0x1450000
end_va = 0x14e2fff
monitored = 0
entry_point = 0x14c9000
region_type = mapped_file
name = "afd.sys"
filename = "\\Windows\\System32\\drivers\\afd.sys" (normalized: "c:\\windows\\system32\\drivers\\afd.sys")
Region:
id = 1856
start_va = 0x410000
end_va = 0x415fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "fvevol.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui")
Region:
id = 1857
start_va = 0x1450000
end_va = 0x14f0fff
monitored = 0
entry_point = 0x14e3000
region_type = mapped_file
name = "fvevol.sys"
filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys")
Region:
id = 1858
start_va = 0x410000
end_va = 0x415fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "fvevol.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\fvevol.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\fvevol.sys.mui")
Region:
id = 1859
start_va = 0x1450000
end_va = 0x14f0fff
monitored = 0
entry_point = 0x14e3000
region_type = mapped_file
name = "fvevol.sys"
filename = "\\Windows\\System32\\drivers\\fvevol.sys" (normalized: "c:\\windows\\system32\\drivers\\fvevol.sys")
Region:
id = 1860
start_va = 0x410000
end_va = 0x41afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "spaceport.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui")
Region:
id = 1861
start_va = 0x1450000
end_va = 0x14d5fff
monitored = 0
entry_point = 0x14c1000
region_type = mapped_file
name = "spaceport.sys"
filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys")
Region:
id = 1862
start_va = 0x410000
end_va = 0x41afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "spaceport.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui")
Region:
id = 1863
start_va = 0x1450000
end_va = 0x14d5fff
monitored = 0
entry_point = 0x14c1000
region_type = mapped_file
name = "spaceport.sys"
filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys")
Region:
id = 1864
start_va = 0x410000
end_va = 0x41afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "spaceport.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui")
Region:
id = 1865
start_va = 0x1450000
end_va = 0x14d5fff
monitored = 0
entry_point = 0x14c1000
region_type = mapped_file
name = "spaceport.sys"
filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys")
Region:
id = 1866
start_va = 0x410000
end_va = 0x41afff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "spaceport.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\spaceport.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\spaceport.sys.mui")
Region:
id = 1867
start_va = 0x1450000
end_va = 0x14d5fff
monitored = 0
entry_point = 0x14c1000
region_type = mapped_file
name = "spaceport.sys"
filename = "\\Windows\\System32\\drivers\\spaceport.sys" (normalized: "c:\\windows\\system32\\drivers\\spaceport.sys")
Region:
id = 1869
start_va = 0x410000
end_va = 0x41efff
monitored = 0
entry_point = 0x4136e0
region_type = mapped_file
name = "dmvsc.sys"
filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys")
Region:
id = 1870
start_va = 0x420000
end_va = 0x421fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "dmvsc.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui")
Region:
id = 1871
start_va = 0x410000
end_va = 0x41efff
monitored = 0
entry_point = 0x4136e0
region_type = mapped_file
name = "dmvsc.sys"
filename = "\\Windows\\System32\\drivers\\dmvsc.sys" (normalized: "c:\\windows\\system32\\drivers\\dmvsc.sys")
Region:
id = 1872
start_va = 0x420000
end_va = 0x421fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "dmvsc.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\dmvsc.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\dmvsc.sys.mui")
Region:
id = 1873
start_va = 0x410000
end_va = 0x42afff
monitored = 1
entry_point = 0x411190
region_type = mapped_file
name = "servicemodelperformancecounters.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll")
Region:
id = 1874
start_va = 0x430000
end_va = 0x43bfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "servicemodelperformancecounters.dll.mui"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui")
Region:
id = 1875
start_va = 0x410000
end_va = 0x42afff
monitored = 1
entry_point = 0x411190
region_type = mapped_file
name = "servicemodelperformancecounters.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll")
Region:
id = 1876
start_va = 0x430000
end_va = 0x43bfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "servicemodelperformancecounters.dll.mui"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui")
Region:
id = 1877
start_va = 0x410000
end_va = 0x42afff
monitored = 1
entry_point = 0x411190
region_type = mapped_file
name = "servicemodelperformancecounters.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll")
Region:
id = 1878
start_va = 0x430000
end_va = 0x43bfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "servicemodelperformancecounters.dll.mui"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui")
Region:
id = 1879
start_va = 0x410000
end_va = 0x42afff
monitored = 1
entry_point = 0x411190
region_type = mapped_file
name = "servicemodelperformancecounters.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll")
Region:
id = 1880
start_va = 0x430000
end_va = 0x43bfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "servicemodelperformancecounters.dll.mui"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui")
Region:
id = 1881
start_va = 0x410000
end_va = 0x42afff
monitored = 1
entry_point = 0x411190
region_type = mapped_file
name = "servicemodelperformancecounters.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll")
Region:
id = 1882
start_va = 0x430000
end_va = 0x43bfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "servicemodelperformancecounters.dll.mui"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui")
Region:
id = 1883
start_va = 0x410000
end_va = 0x42afff
monitored = 1
entry_point = 0x411190
region_type = mapped_file
name = "servicemodelperformancecounters.dll"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\ServiceModelPerformanceCounters.dll" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\servicemodelperformancecounters.dll")
Region:
id = 1884
start_va = 0x430000
end_va = 0x43bfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "servicemodelperformancecounters.dll.mui"
filename = "\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\en-US\\ServiceModelPerformanceCounters.dll.mui" (normalized: "c:\\windows\\microsoft.net\\framework64\\v4.0.30319\\en-us\\servicemodelperformancecounters.dll.mui")
Region:
id = 1886
start_va = 0x410000
end_va = 0x411fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "dosvc.dll.mui"
filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui")
Region:
id = 1887
start_va = 0x1910000
end_va = 0x1a1efff
monitored = 0
entry_point = 0x194c010
region_type = mapped_file
name = "dosvc.dll"
filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll")
Region:
id = 1888
start_va = 0x410000
end_va = 0x411fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "dosvc.dll.mui"
filename = "\\Windows\\System32\\en-US\\dosvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\dosvc.dll.mui")
Region:
id = 1889
start_va = 0x1910000
end_va = 0x1a1efff
monitored = 0
entry_point = 0x194c010
region_type = mapped_file
name = "dosvc.dll"
filename = "\\Windows\\System32\\dosvc.dll" (normalized: "c:\\windows\\system32\\dosvc.dll")
Region:
id = 1903
start_va = 0x410000
end_va = 0x426fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "tcpip.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui")
Region:
id = 1904
start_va = 0x1910000
end_va = 0x1b66fff
monitored = 0
entry_point = 0x1b1ce10
region_type = mapped_file
name = "tcpip.sys"
filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys")
Region:
id = 1905
start_va = 0x410000
end_va = 0x426fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "tcpip.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\tcpip.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\tcpip.sys.mui")
Region:
id = 1906
start_va = 0x1910000
end_va = 0x1b66fff
monitored = 0
entry_point = 0x1b1ce10
region_type = mapped_file
name = "tcpip.sys"
filename = "\\Windows\\System32\\drivers\\tcpip.sys" (normalized: "c:\\windows\\system32\\drivers\\tcpip.sys")
Region:
id = 1907
start_va = 0x410000
end_va = 0x419fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "http.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui")
Region:
id = 1908
start_va = 0x1910000
end_va = 0x1a20fff
monitored = 0
entry_point = 0x1a01bf0
region_type = mapped_file
name = "http.sys"
filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys")
Region:
id = 1909
start_va = 0x410000
end_va = 0x419fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "http.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui")
Region:
id = 1910
start_va = 0x1910000
end_va = 0x1a20fff
monitored = 0
entry_point = 0x1a01bf0
region_type = mapped_file
name = "http.sys"
filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys")
Region:
id = 1911
start_va = 0x410000
end_va = 0x419fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "http.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui")
Region:
id = 1912
start_va = 0x1910000
end_va = 0x1a20fff
monitored = 0
entry_point = 0x1a01bf0
region_type = mapped_file
name = "http.sys"
filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys")
Region:
id = 1913
start_va = 0x410000
end_va = 0x419fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "http.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui")
Region:
id = 1914
start_va = 0x1910000
end_va = 0x1a20fff
monitored = 0
entry_point = 0x1a01bf0
region_type = mapped_file
name = "http.sys"
filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys")
Region:
id = 1915
start_va = 0x410000
end_va = 0x419fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "http.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui")
Region:
id = 1916
start_va = 0x1910000
end_va = 0x1a20fff
monitored = 0
entry_point = 0x1a01bf0
region_type = mapped_file
name = "http.sys"
filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys")
Region:
id = 1917
start_va = 0x410000
end_va = 0x419fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "http.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\http.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\http.sys.mui")
Region:
id = 1918
start_va = 0x1910000
end_va = 0x1a20fff
monitored = 0
entry_point = 0x1a01bf0
region_type = mapped_file
name = "http.sys"
filename = "\\Windows\\System32\\drivers\\http.sys" (normalized: "c:\\windows\\system32\\drivers\\http.sys")
Region:
id = 1919
start_va = 0x410000
end_va = 0x41ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "psevents.dll"
filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll")
Region:
id = 1920
start_va = 0x420000
end_va = 0x42dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "psevents.dll.mui"
filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui")
Region:
id = 1921
start_va = 0x410000
end_va = 0x41ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "psevents.dll"
filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\PSEvents.dll" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\psevents.dll")
Region:
id = 1922
start_va = 0x420000
end_va = 0x42dfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "psevents.dll.mui"
filename = "\\Windows\\System32\\WindowsPowerShell\\v1.0\\en-US\\PSEvents.dll.mui" (normalized: "c:\\windows\\system32\\windowspowershell\\v1.0\\en-us\\psevents.dll.mui")
Region:
id = 1927
start_va = 0x410000
end_va = 0x421fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "srv2.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui")
Region:
id = 1928
start_va = 0x1450000
end_va = 0x14fefff
monitored = 0
entry_point = 0x14c7000
region_type = mapped_file
name = "srv2.sys"
filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys")
Region:
id = 1929
start_va = 0x410000
end_va = 0x421fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "srv2.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui")
Region:
id = 1930
start_va = 0x1450000
end_va = 0x14fefff
monitored = 0
entry_point = 0x14c7000
region_type = mapped_file
name = "srv2.sys"
filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys")
Region:
id = 1931
start_va = 0x410000
end_va = 0x421fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "srv2.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui")
Region:
id = 1932
start_va = 0x1450000
end_va = 0x14fefff
monitored = 0
entry_point = 0x14c7000
region_type = mapped_file
name = "srv2.sys"
filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys")
Region:
id = 1933
start_va = 0x410000
end_va = 0x421fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "srv2.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui")
Region:
id = 1934
start_va = 0x1450000
end_va = 0x14fefff
monitored = 0
entry_point = 0x14c7000
region_type = mapped_file
name = "srv2.sys"
filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys")
Region:
id = 1935
start_va = 0x410000
end_va = 0x421fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "srv2.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui")
Region:
id = 1936
start_va = 0x1450000
end_va = 0x14fefff
monitored = 0
entry_point = 0x14c7000
region_type = mapped_file
name = "srv2.sys"
filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys")
Region:
id = 1937
start_va = 0x410000
end_va = 0x421fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "srv2.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\srv2.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\srv2.sys.mui")
Region:
id = 1938
start_va = 0x1450000
end_va = 0x14fefff
monitored = 0
entry_point = 0x14c7000
region_type = mapped_file
name = "srv2.sys"
filename = "\\Windows\\System32\\drivers\\srv2.sys" (normalized: "c:\\windows\\system32\\drivers\\srv2.sys")
Region:
id = 1939
start_va = 0x410000
end_va = 0x470fff
monitored = 0
entry_point = 0x420770
region_type = mapped_file
name = "usbxhci.sys"
filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys")
Region:
id = 1940
start_va = 0x4d0000
end_va = 0x4d3fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "usbxhci.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui")
Region:
id = 1941
start_va = 0x410000
end_va = 0x470fff
monitored = 0
entry_point = 0x420770
region_type = mapped_file
name = "usbxhci.sys"
filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys")
Region:
id = 1942
start_va = 0x4d0000
end_va = 0x4d3fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "usbxhci.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui")
Region:
id = 1943
start_va = 0x410000
end_va = 0x470fff
monitored = 0
entry_point = 0x420770
region_type = mapped_file
name = "usbxhci.sys"
filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys")
Region:
id = 1944
start_va = 0x4d0000
end_va = 0x4d3fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "usbxhci.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui")
Region:
id = 1945
start_va = 0x410000
end_va = 0x470fff
monitored = 0
entry_point = 0x420770
region_type = mapped_file
name = "usbxhci.sys"
filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys")
Region:
id = 1946
start_va = 0x4d0000
end_va = 0x4d3fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "usbxhci.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui")
Region:
id = 1947
start_va = 0x410000
end_va = 0x470fff
monitored = 0
entry_point = 0x420770
region_type = mapped_file
name = "usbxhci.sys"
filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys")
Region:
id = 1948
start_va = 0x4d0000
end_va = 0x4d3fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "usbxhci.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui")
Region:
id = 1949
start_va = 0x410000
end_va = 0x470fff
monitored = 0
entry_point = 0x420770
region_type = mapped_file
name = "usbxhci.sys"
filename = "\\Windows\\System32\\drivers\\USBXHCI.SYS" (normalized: "c:\\windows\\system32\\drivers\\usbxhci.sys")
Region:
id = 1950
start_va = 0x4d0000
end_va = 0x4d3fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "usbxhci.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\USBXHCI.SYS.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\usbxhci.sys.mui")
Region:
id = 1951
start_va = 0x410000
end_va = 0x420fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ndis.sys.mui"
filename = "\\Windows\\System32\\drivers\\en-US\\ndis.sys.mui" (normalized: "c:\\windows\\system32\\drivers\\en-us\\ndis.sys.mui")
Region:
id = 1952
start_va = 0x1910000
end_va = 0x1a2ffff
monitored = 0
entry_point = 0x1a0c040
region_type = mapped_file
name = "ndis.sys"
filename = "\\Windows\\System32\\drivers\\ndis.sys" (normalized: "c:\\windows\\system32\\drivers\\ndis.sys")
Region:
id = 1958
start_va = 0x1910000
end_va = 0x1b0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001910000"
filename = ""
Region:
id = 1959
start_va = 0x7ff87aab0000
end_va = 0x7ff87aabdfff
monitored = 0
entry_point = 0x7ff87aab2b10
region_type = mapped_file
name = "perfos.dll"
filename = "\\Windows\\System32\\perfos.dll" (normalized: "c:\\windows\\system32\\perfos.dll")
Thread:
id = 120
os_tid = 0x13f8
Thread:
id = 121
os_tid = 0x13f4
[0233.155] ?AddRef@?$CImpl@UIWbemObjectTextSrc@@VCWmiObjectTextSrc@@@@UEAAKXZ () returned 0x2
[0233.241] RtlRestoreLastWin32Error () returned 0x376000
[0233.241] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x11ce118, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x11ce010 | out: pulNumLanguages=0x11ce118, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x11ce010) returned 1
[0233.241] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x548bb0
[0233.241] RtlRestoreLastWin32Error () returned 0x376000
[0233.241] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x11ce118, pwszLanguagesBuffer=0x548bb0, pcchLanguagesBuffer=0x11ce010 | out: pulNumLanguages=0x11ce118, pwszLanguagesBuffer=0x548bb0, pcchLanguagesBuffer=0x11ce010) returned 1
[0233.241] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x548bc0
[0233.241] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x548bb0) returned 1
[0233.241] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x57d390
[0233.241] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x57d390, pulNumLanguages=0x11ce118 | out: pulNumLanguages=0x11ce118) returned 1
[0233.241] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x57d390) returned 1
[0233.335] LoadStringW (in: hInstance=0x7ff865730000, uID=0x3e, lpBuffer=0x11cd6c0, cchBufferMax=256 | out: lpBuffer="Base Board") returned 0xa
[0233.337] lstrlenW (lpString="Dell Inc.") returned 9
[0233.338] lstrlenW (lpString="0G3HR7") returned 6
[0233.338] lstrlenW (lpString="A00") returned 3
[0233.339] lstrlenW (lpString="..XXXXXXXXXXXXX.") returned 16
[0233.447] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x548bb0
[0233.447] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x548bb0, pulNumLanguages=0x11ce1c0 | out: pulNumLanguages=0x11ce1c0) returned 1
[0233.447] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x548bb0) returned 1
[0233.447] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x548bc0) returned 1
[0238.532] RtlRestoreLastWin32Error () returned 0x376000
[0238.532] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x11ce118, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x11ce010 | out: pulNumLanguages=0x11ce118, pwszLanguagesBuffer=0x0, pcchLanguagesBuffer=0x11ce010) returned 1
[0238.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x548bb0
[0238.560] RtlRestoreLastWin32Error () returned 0x376000
[0238.560] GetThreadPreferredUILanguages (in: dwFlags=0x40, pulNumLanguages=0x11ce118, pwszLanguagesBuffer=0x548bb0, pcchLanguagesBuffer=0x11ce010 | out: pulNumLanguages=0x11ce118, pwszLanguagesBuffer=0x548bb0, pcchLanguagesBuffer=0x11ce010) returned 1
[0238.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x8) returned 0x548bc0
[0238.560] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x548bb0) returned 1
[0238.560] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x14) returned 0x57d070
[0238.560] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x57d070, pulNumLanguages=0x11ce118 | out: pulNumLanguages=0x11ce118) returned 1
[0238.560] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x57d070) returned 1
[0238.566] malloc (_Size=0x600) returned 0xdf89c0
[0238.567] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0x0, ReturnedLength=0x11cd7f8 | out: Buffer=0x0, ReturnedLength=0x11cd7f8) returned 0
[0238.567] GetLastError () returned 0x7a
[0238.567] malloc (_Size=0x250) returned 0xdf5c50
[0238.567] GetLogicalProcessorInformationEx (in: RelationshipType=0xffff, Buffer=0xdf5c50, ReturnedLength=0x11cd7f8 | out: Buffer=0xdf5c50, ReturnedLength=0x11cd7f8) returned 1
[0238.567] GetActiveProcessorCount (GroupNumber=0xffff) returned 0x4
[0238.567] GetMaximumProcessorGroupCount () returned 0x1
[0238.567] malloc (_Size=0x40) returned 0xdf1d30
[0238.567] malloc (_Size=0x40) returned 0xdf19c0
[0238.567] malloc (_Size=0x8) returned 0xdf5c20
[0238.567] memcpy (in: _Dst=0xdf1d30, _Src=0xdf5c70, _Size=0x10 | out: _Dst=0xdf1d30) returned 0xdf1d30
[0238.597] GetActiveProcessorCount (GroupNumber=0x0) returned 0x4
[0238.597] NtPowerInformation (in: InformationLevel=0x2e, InputBuffer=0x11cd7f0, InputBufferLength=0x2, OutputBuffer=0xdf89c0, OutputBufferLength=0x60 | out: OutputBuffer=0xdf89c0) returned 0x0
[0238.598] _vsnwprintf (in: _Buffer=0x11cd690, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x11ccf88 | out: _Buffer="CPU0") returned 4
[0238.598] GetCurrentThread () returned 0xfffffffffffffffe
[0238.599] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x11ccee0, PreviousGroupAffinity=0x11ccef0 | out: PreviousGroupAffinity=0x11ccef0) returned 1
[0238.601] GetSystemInfo (in: lpSystemInfo=0x11cd020 | out: lpSystemInfo=0x11cd020*(dwOemId=0x9, wProcessorArchitecture=0x9, wReserved=0x0, dwPageSize=0x1000, lpMinimumApplicationAddress=0x10000, lpMaximumApplicationAddress=0x7ffffffeffff, dwActiveProcessorMask=0xf, dwNumberOfProcessors=0x4, dwProcessorType=0x21d8, dwAllocationGranularity=0x10000, wProcessorLevel=0x6, wProcessorRevision=0x5507))
[0238.601] mbstowcs (in: _Dest=0x11cd2a8, _Source="GenuineIntel", _MaxCount=0x28 | out: _Dest="GenuineIntel") returned 0xc
[0238.601] _wcsicmp (_String1="GenuineIntel", _String2="GenuineIntel") returned 0
[0238.603] mbstowcs (in: _Dest=0x11cd118, _Source="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz", _MaxCount=0x28 | out: _Dest="Intel(R) Core(TM) i5-7500 CPU @ 3.40GHz") returned 0x27
[0238.603] GetCurrentThread () returned 0xfffffffffffffffe
[0238.603] SetThreadGroupAffinity (in: hThread=0xfffffffffffffffe, GroupAffinity=0x11ccef0, PreviousGroupAffinity=0x0 | out: PreviousGroupAffinity=0x0) returned 1
[0238.610] LoadStringW (in: hInstance=0x7ff865730000, uID=0x2c, lpBuffer=0x11cccf0, cchBufferMax=256 | out: lpBuffer="CPU %d") returned 0x6
[0250.129] malloc (_Size=0x34c34) returned 0xdf98f0
[0250.139] _wtoi (_String="238") returned 238
[0250.139] _wtoi (_String="6") returned 6
[0250.139] _itow (in: _Dest=0x0, _Radix=18666944 | out: _Dest=0x0) returned="0"
[0250.139] _itow (in: _Dest=0xee, _Radix=18665232 | out: _Dest=0xee) returned="238"
[0250.139] malloc (_Size=0x4000) returned 0xe2e530
[0250.140] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe2e530, lpcbData=0x11ccee4*=0x4000 | out: lpType=0x0, lpData=0xe2e530*=0x50, lpcbData=0x11ccee4*=0x600) returned 0x0
[0250.300] free (_Block=0xe2e530)
[0250.300] Sleep (dwMilliseconds=0x3e8)
[0251.675] _itow (in: _Dest=0xee, _Radix=18665232 | out: _Dest=0xee) returned="238"
[0251.675] malloc (_Size=0x4000) returned 0xe2e530
[0251.675] RegQueryValueExW (in: hKey=0xffffffff80000004, lpValueName="238", lpReserved=0x0, lpType=0x0, lpData=0xe2e530, lpcbData=0x11ccee4*=0x4000 | out: lpType=0x0, lpData=0xe2e530*=0x50, lpcbData=0x11ccee4*=0x600) returned 0x0
[0251.827] free (_Block=0xe2e530)
[0251.829] free (_Block=0xdf98f0)
[0251.838] _vsnwprintf (in: _Buffer=0x11cd5c0, _BufferCount=0x40, _Format="%04X%04X%04X%04X", _ArgList=0x11ccf88 | out: _Buffer="0F8BFBFF00050657") returned 16
[0251.868] lstrlenW (lpString=" 0") returned 2
[0251.869] lstrlenW (lpString="Intel(R) Xeon(R) Gold 6226 CPU @ 2.70GHz") returned 40
[0251.870] lstrlenW (lpString="") returned 0
[0251.871] lstrlenW (lpString="") returned 0
[0251.877] lstrlenW (lpString="") returned 0
[0251.879] IsProcessorFeaturePresent (ProcessorFeature=0x14) returned 1
[0251.879] IsProcessorFeaturePresent (ProcessorFeature=0x15) returned 1
[0251.882] RtlNumberOfSetBitsUlongPtr (Target=0x1) returned 0x1
[0251.882] RtlNumberOfSetBitsUlongPtr (Target=0x2) returned 0x1
[0251.882] RtlNumberOfSetBitsUlongPtr (Target=0x4) returned 0x1
[0251.882] RtlNumberOfSetBitsUlongPtr (Target=0x8) returned 0x1
[0251.882] _vsnwprintf (in: _Buffer=0x11cd880, _BufferCount=0x63, _Format="CPU%d", _ArgList=0x11cd7c8 | out: _Buffer="CPU0") returned 4
[0251.883] free (_Block=0xdf5c20)
[0251.884] free (_Block=0xdf19c0)
[0251.884] free (_Block=0xdf1d30)
[0251.885] free (_Block=0xdf5c50)
[0251.885] free (_Block=0xdf89c0)
[0251.902] RtlAllocateHeap (HeapHandle=0x520000, Flags=0x0, Size=0x4) returned 0x588190
[0251.902] SetThreadPreferredUILanguages (in: dwFlags=0x8, pwszLanguagesBuffer=0x588190, pulNumLanguages=0x11ce1c0 | out: pulNumLanguages=0x11ce1c0) returned 1
[0251.902] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x588190) returned 1
[0251.902] RtlFreeHeap (HeapHandle=0x520000, Flags=0x0, BaseAddress=0x548bc0) returned 1
Thread:
id = 122
os_tid = 0x13f0
Thread:
id = 123
os_tid = 0x13e0
Thread:
id = 124
os_tid = 0x139c
Thread:
id = 125
os_tid = 0x1398
Thread:
id = 126
os_tid = 0x1394
Thread:
id = 127
os_tid = 0x138c
Thread:
id = 128
os_tid = 0x1350
Thread:
id = 155
os_tid = 0xa90
Process:
id = "9"
image_name = "wmiprvse.exe"
filename = "c:\\windows\\system32\\wbem\\wmiprvse.exe"
page_root = "0x387b1000"
os_pid = "0x300"
os_integrity_level = "0x4000"
os_privileges = "0xe60b1e890"
monitor_reason = "rpc_server"
parent_id = "6"
os_parent_pid = "0x274"
cmd_line = "C:\\Windows\\system32\\wbem\\wmiprvse.exe -Embedding"
cur_dir = "C:\\Windows\\system32\\"
os_username = "NT AUTHORITY\\SYSTEM"
bitness = "32"
os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xe], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xe], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xe], "NT SERVICE\\LanmanServer" [0xe], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xe], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xe], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xe], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000ac2c" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]
Region:
id = 1965
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 1966
start_va = 0x20000
end_va = 0x26fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 1967
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 1968
start_va = 0x50000
end_va = 0xcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 1969
start_va = 0xd0000
end_va = 0xd3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 1970
start_va = 0xe0000
end_va = 0xe0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 1971
start_va = 0xf0000
end_va = 0xf1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000f0000"
filename = ""
Region:
id = 1972
start_va = 0x100000
end_va = 0x1bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 1973
start_va = 0x1c0000
end_va = 0x1c6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 1974
start_va = 0x1d0000
end_va = 0x1d0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001d0000"
filename = ""
Region:
id = 1975
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001e0000"
filename = ""
Region:
id = 1976
start_va = 0x1f0000
end_va = 0x1f1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001f0000"
filename = ""
Region:
id = 1977
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 1978
start_va = 0x400000
end_va = 0x400fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000400000"
filename = ""
Region:
id = 1979
start_va = 0x410000
end_va = 0x414fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "user32.dll.mui"
filename = "\\Windows\\System32\\en-US\\user32.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\user32.dll.mui")
Region:
id = 1980
start_va = 0x420000
end_va = 0x420fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000420000"
filename = ""
Region:
id = 1981
start_va = 0x430000
end_va = 0x430fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000430000"
filename = ""
Region:
id = 1982
start_va = 0x440000
end_va = 0x440fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000440000"
filename = ""
Region:
id = 1983
start_va = 0x470000
end_va = 0x56ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000470000"
filename = ""
Region:
id = 1984
start_va = 0x5f0000
end_va = 0x6affff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000005f0000"
filename = ""
Region:
id = 1985
start_va = 0x6b0000
end_va = 0x72ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000006b0000"
filename = ""
Region:
id = 1986
start_va = 0x740000
end_va = 0x74ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000740000"
filename = ""
Region:
id = 1987
start_va = 0x750000
end_va = 0xa86fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 1988
start_va = 0xa90000
end_va = 0xc17fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000a90000"
filename = ""
Region:
id = 1989
start_va = 0xc20000
end_va = 0xda0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000c20000"
filename = ""
Region:
id = 1990
start_va = 0xdb0000
end_va = 0xeaffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000db0000"
filename = ""
Region:
id = 1991
start_va = 0xeb0000
end_va = 0xf2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000eb0000"
filename = ""
Region:
id = 1992
start_va = 0xf30000
end_va = 0xfaffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f30000"
filename = ""
Region:
id = 1993
start_va = 0xfb0000
end_va = 0x102ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000fb0000"
filename = ""
Region:
id = 1994
start_va = 0x1030000
end_va = 0x10affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001030000"
filename = ""
Region:
id = 1995
start_va = 0x10b0000
end_va = 0x112ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000010b0000"
filename = ""
Region:
id = 1996
start_va = 0x1130000
end_va = 0x11affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001130000"
filename = ""
Region:
id = 1997
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 1998
start_va = 0x7df5ffec0000
end_va = 0x7df5fffbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffec0000"
filename = ""
Region:
id = 1999
start_va = 0x7df5fffc0000
end_va = 0x7df5fffe2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5fffc0000"
filename = ""
Region:
id = 2000
start_va = 0x7df5ffff0000
end_va = 0x7ff5fffeffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffff0000"
filename = ""
Region:
id = 2001
start_va = 0x7ff748430000
end_va = 0x7ff7484affff
monitored = 0
entry_point = 0x7ff748445f50
region_type = mapped_file
name = "wmiprvse.exe"
filename = "\\Windows\\System32\\wbem\\WmiPrvSE.exe" (normalized: "c:\\windows\\system32\\wbem\\wmiprvse.exe")
Region:
id = 2002
start_va = 0x7ff8656b0000
end_va = 0x7ff8656fcfff
monitored = 0
entry_point = 0x7ff8656bb470
region_type = mapped_file
name = "pdh.dll"
filename = "\\Windows\\System32\\pdh.dll" (normalized: "c:\\windows\\system32\\pdh.dll")
Region:
id = 2003
start_va = 0x7ff865700000
end_va = 0x7ff865724fff
monitored = 1
entry_point = 0x7ff865715dc0
region_type = mapped_file
name = "wmiperfclass.dll"
filename = "\\Windows\\System32\\wbem\\WmiPerfClass.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiperfclass.dll")
Region:
id = 2004
start_va = 0x7ff8702c0000
end_va = 0x7ff8702d5fff
monitored = 0
entry_point = 0x7ff8702c55e0
region_type = mapped_file
name = "ncobjapi.dll"
filename = "\\Windows\\System32\\ncobjapi.dll" (normalized: "c:\\windows\\system32\\ncobjapi.dll")
Region:
id = 2005
start_va = 0x7ff870430000
end_va = 0x7ff870454fff
monitored = 0
entry_point = 0x7ff870439900
region_type = mapped_file
name = "wmiutils.dll"
filename = "\\Windows\\System32\\wbem\\wmiutils.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiutils.dll")
Region:
id = 2006
start_va = 0x7ff870460000
end_va = 0x7ff870473fff
monitored = 0
entry_point = 0x7ff870461800
region_type = mapped_file
name = "wbemsvc.dll"
filename = "\\Windows\\System32\\wbem\\wbemsvc.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemsvc.dll")
Region:
id = 2007
start_va = 0x7ff870480000
end_va = 0x7ff870575fff
monitored = 0
entry_point = 0x7ff8704b9590
region_type = mapped_file
name = "fastprox.dll"
filename = "\\Windows\\System32\\wbem\\fastprox.dll" (normalized: "c:\\windows\\system32\\wbem\\fastprox.dll")
Region:
id = 2008
start_va = 0x7ff870890000
end_va = 0x7ff8708a0fff
monitored = 0
entry_point = 0x7ff870892fc0
region_type = mapped_file
name = "wbemprox.dll"
filename = "\\Windows\\System32\\wbem\\wbemprox.dll" (normalized: "c:\\windows\\system32\\wbem\\wbemprox.dll")
Region:
id = 2009
start_va = 0x7ff872310000
end_va = 0x7ff87238efff
monitored = 1
entry_point = 0x7ff872327110
region_type = mapped_file
name = "wbemcomn.dll"
filename = "\\Windows\\System32\\wbemcomn.dll" (normalized: "c:\\windows\\system32\\wbemcomn.dll")
Region:
id = 2010
start_va = 0x7ff878a40000
end_va = 0x7ff878a7cfff
monitored = 1
entry_point = 0x7ff878a4b760
region_type = mapped_file
name = "wmiprov.dll"
filename = "\\Windows\\System32\\wbem\\wmiprov.dll" (normalized: "c:\\windows\\system32\\wbem\\wmiprov.dll")
Region:
id = 2011
start_va = 0x7ff87b6f0000
end_va = 0x7ff87b700fff
monitored = 0
entry_point = 0x7ff87b6f3320
region_type = mapped_file
name = "wmiclnt.dll"
filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll")
Region:
id = 2012
start_va = 0x7ff87d7f0000
end_va = 0x7ff87d853fff
monitored = 0
entry_point = 0x7ff87d805ae0
region_type = mapped_file
name = "wevtapi.dll"
filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")
Region:
id = 2013
start_va = 0x7ff8807d0000
end_va = 0x7ff880800fff
monitored = 0
entry_point = 0x7ff8807d7d10
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")
Region:
id = 2014
start_va = 0x7ff881170000
end_va = 0x7ff881198fff
monitored = 0
entry_point = 0x7ff881184530
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 2015
start_va = 0x7ff881330000
end_va = 0x7ff88133efff
monitored = 0
entry_point = 0x7ff881333210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 2016
start_va = 0x7ff881d50000
end_va = 0x7ff881db9fff
monitored = 0
entry_point = 0x7ff881d86d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 2017
start_va = 0x7ff881ed0000
end_va = 0x7ff8820b7fff
monitored = 0
entry_point = 0x7ff881efba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 2018
start_va = 0x7ff8820c0000
end_va = 0x7ff882215fff
monitored = 0
entry_point = 0x7ff8820ca8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 2019
start_va = 0x7ff882220000
end_va = 0x7ff8822bcfff
monitored = 0
entry_point = 0x7ff8822278a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 2020
start_va = 0x7ff8822c0000
end_va = 0x7ff88253cfff
monitored = 0
entry_point = 0x7ff882394970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 2021
start_va = 0x7ff882550000
end_va = 0x7ff8825aafff
monitored = 0
entry_point = 0x7ff8825638b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 2022
start_va = 0x7ff883b80000
end_va = 0x7ff883beafff
monitored = 0
entry_point = 0x7ff883b990c0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 2023
start_va = 0x7ff883bf0000
end_va = 0x7ff883d0bfff
monitored = 0
entry_point = 0x7ff883c302b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 2024
start_va = 0x7ff8841b0000
end_va = 0x7ff884256fff
monitored = 0
entry_point = 0x7ff8841bb4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 2025
start_va = 0x7ff884410000
end_va = 0x7ff8844d0fff
monitored = 0
entry_point = 0x7ff884430da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 2026
start_va = 0x7ff884920000
end_va = 0x7ff8849c6fff
monitored = 0
entry_point = 0x7ff8849358d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 2027
start_va = 0x7ff884a10000
end_va = 0x7ff884b95fff
monitored = 0
entry_point = 0x7ff884a5ffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 2028
start_va = 0x7ff884c10000
end_va = 0x7ff884cbcfff
monitored = 0
entry_point = 0x7ff884c281a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 2029
start_va = 0x7ff884cc0000
end_va = 0x7ff884e80fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Thread:
id = 129
os_tid = 0x764
Thread:
id = 130
os_tid = 0xc64
Thread:
id = 131
os_tid = 0x224
[0259.362] DllCanUnloadNow () returned 0x1
[0259.362] DllCanUnloadNow () returned 0x1
Thread:
id = 132
os_tid = 0x5a0
Thread:
id = 133
os_tid = 0x7e4
Thread:
id = 134
os_tid = 0x4d8
Thread:
id = 135
os_tid = 0xf3c
Thread:
id = 136
os_tid = 0x164
Thread:
id = 156
os_tid = 0xc90
Process:
id = "10"
image_name = "svchost.exe"
filename = "c:\\windows\\system32\\svchost.exe"
page_root = "0x69d83000"
os_pid = "0x358"
os_integrity_level = "0x4000"
os_privileges = "0xe60b1e890"
monitor_reason = "created_scheduled_job"
parent_id = "4"
os_parent_pid = "0x210"
cmd_line = "C:\\Windows\\system32\\svchost.exe -k netsvcs"
cur_dir = "C:\\Windows\\system32\\"
os_username = "NT AUTHORITY\\SYSTEM"
bitness = "32"
os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xa], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xa], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xa], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xa], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b1d9" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]
Region:
id = 2141
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 2142
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 2143
start_va = 0x50000
end_va = 0xcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 2144
start_va = 0xd0000
end_va = 0xd3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 2145
start_va = 0xe0000
end_va = 0xe0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 2146
start_va = 0xf0000
end_va = 0xf1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000f0000"
filename = ""
Region:
id = 2147
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 2148
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 2149
start_va = 0x7df5fffc0000
end_va = 0x7df5fffe2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5fffc0000"
filename = ""
Region:
id = 2150
start_va = 0x7df5ffff0000
end_va = 0x7ff5fffeffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffff0000"
filename = ""
Region:
id = 2151
start_va = 0x7ff733e30000
end_va = 0x7ff733e3cfff
monitored = 0
entry_point = 0x7ff733e33980
region_type = mapped_file
name = "svchost.exe"
filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")
Region:
id = 2152
start_va = 0x7ffd6a2b0000
end_va = 0x7ffd6a470fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 2270
start_va = 0x1a0000
end_va = 0x1a6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001a0000"
filename = ""
Region:
id = 2271
start_va = 0x400000
end_va = 0x4fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 2272
start_va = 0x7ffd66e20000
end_va = 0x7ffd67007fff
monitored = 0
entry_point = 0x7ffd66e4ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 2273
start_va = 0x7ffd67820000
end_va = 0x7ffd678ccfff
monitored = 0
entry_point = 0x7ffd678381a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 2274
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 2275
start_va = 0x7df5ffec0000
end_va = 0x7df5fffbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffec0000"
filename = ""
Region:
id = 2276
start_va = 0x500000
end_va = 0x5bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 2277
start_va = 0x7ffd683d0000
end_va = 0x7ffd6842afff
monitored = 0
entry_point = 0x7ffd683e38b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 2278
start_va = 0x7ffd67e70000
end_va = 0x7ffd67f8bfff
monitored = 0
entry_point = 0x7ffd67eb02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 2279
start_va = 0x100000
end_va = 0x17ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000100000"
filename = ""
Region:
id = 2280
start_va = 0x7ffd65a70000
end_va = 0x7ffd65b63fff
monitored = 0
entry_point = 0x7ffd65a7a960
region_type = mapped_file
name = "ucrtbase.dll"
filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")
Region:
id = 2281
start_va = 0x7ffd68790000
end_va = 0x7ffd68a0cfff
monitored = 0
entry_point = 0x7ffd68864970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 2282
start_va = 0x7ffd68590000
end_va = 0x7ffd6862cfff
monitored = 0
entry_point = 0x7ffd685978a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 2283
start_va = 0x7ffd66b20000
end_va = 0x7ffd66b89fff
monitored = 0
entry_point = 0x7ffd66b56d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 2284
start_va = 0x5c0000
end_va = 0x746fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000005c0000"
filename = ""
Region:
id = 2285
start_va = 0x750000
end_va = 0x94ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000750000"
filename = ""
Region:
id = 2286
start_va = 0x800000
end_va = 0x8fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000800000"
filename = ""
Region:
id = 2287
start_va = 0x5c0000
end_va = 0x69cfff
monitored = 0
entry_point = 0x61e0b0
region_type = mapped_file
name = "rpcss.dll"
filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")
Region:
id = 2288
start_va = 0x740000
end_va = 0x746fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000740000"
filename = ""
Region:
id = 2289
start_va = 0x7ffd66950000
end_va = 0x7ffd6695efff
monitored = 0
entry_point = 0x7ffd66953210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 2290
start_va = 0x7ffd68630000
end_va = 0x7ffd68785fff
monitored = 0
entry_point = 0x7ffd6863a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 2291
start_va = 0x7ffd68a10000
end_va = 0x7ffd68b95fff
monitored = 0
entry_point = 0x7ffd68a5ffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 2292
start_va = 0x5c0000
end_va = 0x67ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000005c0000"
filename = ""
Region:
id = 2293
start_va = 0x900000
end_va = 0xa87fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000900000"
filename = ""
Region:
id = 2294
start_va = 0xa90000
end_va = 0xc10fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000a90000"
filename = ""
Region:
id = 2295
start_va = 0x20000
end_va = 0x21fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000020000"
filename = ""
Region:
id = 2296
start_va = 0x180000
end_va = 0x180fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000180000"
filename = ""
Region:
id = 2297
start_va = 0x190000
end_va = 0x190fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000190000"
filename = ""
Region:
id = 2298
start_va = 0x1b0000
end_va = 0x1b0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001b0000"
filename = ""
Region:
id = 2299
start_va = 0xc20000
end_va = 0x101afff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000c20000"
filename = ""
Region:
id = 2300
start_va = 0x1020000
end_va = 0x11d6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001020000"
filename = ""
Region:
id = 2301
start_va = 0x11e0000
end_va = 0x13dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000011e0000"
filename = ""
Region:
id = 2302
start_va = 0x1200000
end_va = 0x12fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001200000"
filename = ""
Region:
id = 2303
start_va = 0x1020000
end_va = 0x111ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001020000"
filename = ""
Region:
id = 2304
start_va = 0x11d0000
end_va = 0x11d6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000011d0000"
filename = ""
Region:
id = 2305
start_va = 0x7ffd63a90000
end_va = 0x7ffd63bdcfff
monitored = 0
entry_point = 0x7ffd63ad3da0
region_type = mapped_file
name = "gpsvc.dll"
filename = "\\Windows\\System32\\gpsvc.dll" (normalized: "c:\\windows\\system32\\gpsvc.dll")
Region:
id = 2306
start_va = 0x7ffd65580000
end_va = 0x7ffd6558bfff
monitored = 0
entry_point = 0x7ffd65582480
region_type = mapped_file
name = "sysntfy.dll"
filename = "\\Windows\\System32\\sysntfy.dll" (normalized: "c:\\windows\\system32\\sysntfy.dll")
Region:
id = 2307
start_va = 0x7ffd63a70000
end_va = 0x7ffd63a87fff
monitored = 0
entry_point = 0x7ffd63a75910
region_type = mapped_file
name = "nlaapi.dll"
filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")
Region:
id = 2308
start_va = 0x7ffd61ed0000
end_va = 0x7ffd61ed9fff
monitored = 0
entry_point = 0x7ffd61ed1660
region_type = mapped_file
name = "dsrole.dll"
filename = "\\Windows\\System32\\dsrole.dll" (normalized: "c:\\windows\\system32\\dsrole.dll")
Region:
id = 2309
start_va = 0x7ffd68060000
end_va = 0x7ffd68120fff
monitored = 0
entry_point = 0x7ffd68080da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 2310
start_va = 0x1300000
end_va = 0x1442fff
monitored = 0
entry_point = 0x1328210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 2311
start_va = 0x1300000
end_va = 0x1436fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001300000"
filename = ""
Region:
id = 2312
start_va = 0x1440000
end_va = 0x163ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001440000"
filename = ""
Region:
id = 2313
start_va = 0x1500000
end_va = 0x15fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001500000"
filename = ""
Region:
id = 2314
start_va = 0x1600000
end_va = 0x1936fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 2315
start_va = 0x1300000
end_va = 0x13fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001300000"
filename = ""
Region:
id = 2316
start_va = 0x1430000
end_va = 0x1436fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001430000"
filename = ""
Region:
id = 2317
start_va = 0x1c0000
end_va = 0x1c0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001c0000"
filename = ""
Region:
id = 2318
start_va = 0x7ffd67d10000
end_va = 0x7ffd67db6fff
monitored = 0
entry_point = 0x7ffd67d1b4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 2319
start_va = 0x1d0000
end_va = 0x1d0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001d0000"
filename = ""
Region:
id = 2320
start_va = 0x7ffd61530000
end_va = 0x7ffd615eefff
monitored = 0
entry_point = 0x7ffd61551c50
region_type = mapped_file
name = "taskschd.dll"
filename = "\\Windows\\System32\\taskschd.dll" (normalized: "c:\\windows\\system32\\taskschd.dll")
Region:
id = 2321
start_va = 0x1940000
end_va = 0x1a3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001940000"
filename = ""
Region:
id = 2322
start_va = 0x7ffd61430000
end_va = 0x7ffd6152bfff
monitored = 0
entry_point = 0x7ffd61466df0
region_type = mapped_file
name = "schedsvc.dll"
filename = "\\Windows\\System32\\schedsvc.dll" (normalized: "c:\\windows\\system32\\schedsvc.dll")
Region:
id = 2323
start_va = 0x7ffd613e0000
end_va = 0x7ffd61420fff
monitored = 0
entry_point = 0x7ffd613f7eb0
region_type = mapped_file
name = "ubpm.dll"
filename = "\\Windows\\System32\\ubpm.dll" (normalized: "c:\\windows\\system32\\ubpm.dll")
Region:
id = 2324
start_va = 0x7ffd66740000
end_va = 0x7ffd66758fff
monitored = 0
entry_point = 0x7ffd66745e10
region_type = mapped_file
name = "eventaggregation.dll"
filename = "\\Windows\\System32\\EventAggregation.dll" (normalized: "c:\\windows\\system32\\eventaggregation.dll")
Region:
id = 2325
start_va = 0x1020000
end_va = 0x1116fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001020000"
filename = ""
Region:
id = 2326
start_va = 0x1a40000
end_va = 0x1c3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001a40000"
filename = ""
Region:
id = 2327
start_va = 0x1b00000
end_va = 0x1bfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001b00000"
filename = ""
Region:
id = 2328
start_va = 0x7ffd65b70000
end_va = 0x7ffd65bb8fff
monitored = 0
entry_point = 0x7ffd65b7a090
region_type = mapped_file
name = "authz.dll"
filename = "\\Windows\\System32\\authz.dll" (normalized: "c:\\windows\\system32\\authz.dll")
Region:
id = 2329
start_va = 0x7ffd66900000
end_va = 0x7ffd6694afff
monitored = 0
entry_point = 0x7ffd669035f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 2330
start_va = 0x7ffd613c0000
end_va = 0x7ffd613d0fff
monitored = 0
entry_point = 0x7ffd613c3320
region_type = mapped_file
name = "wmiclnt.dll"
filename = "\\Windows\\System32\\wmiclnt.dll" (normalized: "c:\\windows\\system32\\wmiclnt.dll")
Region:
id = 2331
start_va = 0x1c00000
end_va = 0x1cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001c00000"
filename = ""
Region:
id = 2332
start_va = 0x7ffd665b0000
end_va = 0x7ffd665dcfff
monitored = 0
entry_point = 0x7ffd665c9d40
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 2333
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001e0000"
filename = ""
Region:
id = 2334
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001e0000"
filename = ""
Region:
id = 2335
start_va = 0x7ffd66760000
end_va = 0x7ffd66788fff
monitored = 0
entry_point = 0x7ffd66774530
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 2336
start_va = 0x680000
end_va = 0x6fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000680000"
filename = ""
Region:
id = 2337
start_va = 0x1d00000
end_va = 0x1dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001d00000"
filename = ""
Region:
id = 2338
start_va = 0x1e00000
end_va = 0x1efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001e00000"
filename = ""
Region:
id = 2339
start_va = 0x7ffd61320000
end_va = 0x7ffd6138dfff
monitored = 0
entry_point = 0x7ffd61327f60
region_type = mapped_file
name = "taskcomp.dll"
filename = "\\Windows\\System32\\taskcomp.dll" (normalized: "c:\\windows\\system32\\taskcomp.dll")
Region:
id = 2340
start_va = 0x7ffd65e20000
end_va = 0x7ffd65e50fff
monitored = 0
entry_point = 0x7ffd65e27d10
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")
Region:
id = 2341
start_va = 0x1f00000
end_va = 0x1ffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001f00000"
filename = ""
Region:
id = 2342
start_va = 0x7ffd60e50000
end_va = 0x7ffd60e91fff
monitored = 0
entry_point = 0x7ffd60e527d0
region_type = mapped_file
name = "mstask.dll"
filename = "\\Windows\\System32\\mstask.dll" (normalized: "c:\\windows\\system32\\mstask.dll")
Region:
id = 2343
start_va = 0x750000
end_va = 0x7cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000750000"
filename = ""
Region:
id = 2344
start_va = 0x1e0000
end_va = 0x1e1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001e0000"
filename = ""
Region:
id = 2345
start_va = 0x2000000
end_va = 0x20fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002000000"
filename = ""
Region:
id = 2346
start_va = 0x1020000
end_va = 0x109ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001020000"
filename = ""
Region:
id = 2347
start_va = 0x1110000
end_va = 0x1116fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001110000"
filename = ""
Region:
id = 2348
start_va = 0x7ffd60c40000
end_va = 0x7ffd60c6efff
monitored = 0
entry_point = 0x7ffd60c48910
region_type = mapped_file
name = "wptaskscheduler.dll"
filename = "\\Windows\\System32\\WPTaskScheduler.dll" (normalized: "c:\\windows\\system32\\wptaskscheduler.dll")
Region:
id = 2349
start_va = 0x7ffd67dc0000
end_va = 0x7ffd67e66fff
monitored = 0
entry_point = 0x7ffd67dd58d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 2350
start_va = 0x7ffd60c30000
end_va = 0x7ffd60c3cfff
monitored = 0
entry_point = 0x7ffd60c32ca0
region_type = mapped_file
name = "csystemeventsbrokerclient.dll"
filename = "\\Windows\\System32\\CSystemEventsBrokerClient.dll" (normalized: "c:\\windows\\system32\\csystemeventsbrokerclient.dll")
Region:
id = 2351
start_va = 0x1120000
end_va = 0x119ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001120000"
filename = ""
Region:
id = 2352
start_va = 0x7ffd67f90000
end_va = 0x7ffd67ffafff
monitored = 0
entry_point = 0x7ffd67fa90c0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 2353
start_va = 0x7ffd66200000
end_va = 0x7ffd6625bfff
monitored = 0
entry_point = 0x7ffd66216f70
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")
Region:
id = 2354
start_va = 0x1f0000
end_va = 0x1f0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001f0000"
filename = ""
Region:
id = 2355
start_va = 0x7ffd650c0000
end_va = 0x7ffd650d2fff
monitored = 0
entry_point = 0x7ffd650c2760
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")
Region:
id = 2356
start_va = 0x7ffd65c40000
end_va = 0x7ffd65c95fff
monitored = 0
entry_point = 0x7ffd65c50bf0
region_type = mapped_file
name = "winsta.dll"
filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")
Region:
id = 2357
start_va = 0x2100000
end_va = 0x21fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002100000"
filename = ""
Region:
id = 2358
start_va = 0x7ffd609f0000
end_va = 0x7ffd60a44fff
monitored = 0
entry_point = 0x7ffd609ffc00
region_type = mapped_file
name = "profsvc.dll"
filename = "\\Windows\\System32\\profsvc.dll" (normalized: "c:\\windows\\system32\\profsvc.dll")
Region:
id = 2359
start_va = 0x7ffd668d0000
end_va = 0x7ffd668e3fff
monitored = 0
entry_point = 0x7ffd668d52e0
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 2360
start_va = 0x2200000
end_va = 0x22fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002200000"
filename = ""
Region:
id = 2361
start_va = 0x7ffd609e0000
end_va = 0x7ffd609eafff
monitored = 0
entry_point = 0x7ffd609e1770
region_type = mapped_file
name = "lfsvc.dll"
filename = "\\Windows\\System32\\lfsvc.dll" (normalized: "c:\\windows\\system32\\lfsvc.dll")
Region:
id = 2362
start_va = 0x7ffd60cd0000
end_va = 0x7ffd60d61fff
monitored = 0
entry_point = 0x7ffd60d1a780
region_type = mapped_file
name = "msvcp110_win.dll"
filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll")
Region:
id = 2363
start_va = 0x7ffd60860000
end_va = 0x7ffd609dbfff
monitored = 0
entry_point = 0x7ffd608b1650
region_type = mapped_file
name = "locationframework.dll"
filename = "\\Windows\\System32\\LocationFramework.dll" (normalized: "c:\\windows\\system32\\locationframework.dll")
Region:
id = 2364
start_va = 0x7ffd66c50000
end_va = 0x7ffd66e16fff
monitored = 0
entry_point = 0x7ffd66cadb80
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 2365
start_va = 0x7ffd668f0000
end_va = 0x7ffd668fffff
monitored = 0
entry_point = 0x7ffd668f56e0
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 2366
start_va = 0x7ffd641e0000
end_va = 0x7ffd6421ffff
monitored = 0
entry_point = 0x7ffd641f1960
region_type = mapped_file
name = "brokerlib.dll"
filename = "\\Windows\\System32\\BrokerLib.dll" (normalized: "c:\\windows\\system32\\brokerlib.dll")
Region:
id = 2367
start_va = 0x7ffd607f0000
end_va = 0x7ffd60850fff
monitored = 0
entry_point = 0x7ffd607f4b50
region_type = mapped_file
name = "wlanapi.dll"
filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll")
Region:
id = 2368
start_va = 0x7ffd61620000
end_va = 0x7ffd61655fff
monitored = 0
entry_point = 0x7ffd61630070
region_type = mapped_file
name = "xmllite.dll"
filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")
Region:
id = 2369
start_va = 0x7ffd60720000
end_va = 0x7ffd607e7fff
monitored = 0
entry_point = 0x7ffd607613f0
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")
Region:
id = 2370
start_va = 0x7ffd606f0000
end_va = 0x7ffd60716fff
monitored = 0
entry_point = 0x7ffd606f3bf0
region_type = mapped_file
name = "profsvcext.dll"
filename = "\\Windows\\System32\\profsvcext.dll" (normalized: "c:\\windows\\system32\\profsvcext.dll")
Region:
id = 2371
start_va = 0x7ffd68000000
end_va = 0x7ffd6805bfff
monitored = 0
entry_point = 0x7ffd6801b720
region_type = mapped_file
name = "wldap32.dll"
filename = "\\Windows\\System32\\Wldap32.dll" (normalized: "c:\\windows\\system32\\wldap32.dll")
Region:
id = 2372
start_va = 0x7ffd68ba0000
end_va = 0x7ffd6a0fefff
monitored = 0
entry_point = 0x7ffd68d011f0
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 2373
start_va = 0x7ffd67660000
end_va = 0x7ffd676a2fff
monitored = 0
entry_point = 0x7ffd67674b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 2374
start_va = 0x7ffd67010000
end_va = 0x7ffd67653fff
monitored = 0
entry_point = 0x7ffd671d64b0
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")
Region:
id = 2375
start_va = 0x7ffd6a100000
end_va = 0x7ffd6a151fff
monitored = 0
entry_point = 0x7ffd6a10f530
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 2376
start_va = 0x7ffd66b90000
end_va = 0x7ffd66c44fff
monitored = 0
entry_point = 0x7ffd66bd22e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 2377
start_va = 0x7ffd66090000
end_va = 0x7ffd660aefff
monitored = 0
entry_point = 0x7ffd66095d30
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")
Region:
id = 2378
start_va = 0x7ffd65d40000
end_va = 0x7ffd65d4bfff
monitored = 0
entry_point = 0x7ffd65d427e0
region_type = mapped_file
name = "netutils.dll"
filename = "\\Windows\\System32\\netutils.dll" (normalized: "c:\\windows\\system32\\netutils.dll")
Region:
id = 2379
start_va = 0x7ffd606b0000
end_va = 0x7ffd606edfff
monitored = 0
entry_point = 0x7ffd606ba050
region_type = mapped_file
name = "logoncli.dll"
filename = "\\Windows\\System32\\logoncli.dll" (normalized: "c:\\windows\\system32\\logoncli.dll")
Region:
id = 2380
start_va = 0x2300000
end_va = 0x23dcfff
monitored = 0
entry_point = 0x235e0b0
region_type = mapped_file
name = "rpcss.dll"
filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")
Region:
id = 2381
start_va = 0x2300000
end_va = 0x23fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002300000"
filename = ""
Region:
id = 2382
start_va = 0x7ffd641a0000
end_va = 0x7ffd641a7fff
monitored = 0
entry_point = 0x7ffd641a13e0
region_type = mapped_file
name = "dabapi.dll"
filename = "\\Windows\\System32\\dabapi.dll" (normalized: "c:\\windows\\system32\\dabapi.dll")
Region:
id = 2383
start_va = 0x7ffd658d0000
end_va = 0x7ffd658f3fff
monitored = 0
entry_point = 0x7ffd658d3260
region_type = mapped_file
name = "gpapi.dll"
filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")
Region:
id = 2384
start_va = 0x7ffd60c70000
end_va = 0x7ffd60c7ffff
monitored = 0
entry_point = 0x7ffd60c72c60
region_type = mapped_file
name = "usermgrcli.dll"
filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll")
Region:
id = 2385
start_va = 0x7ffd605d0000
end_va = 0x7ffd605dbfff
monitored = 0
entry_point = 0x7ffd605d14d0
region_type = mapped_file
name = "locationframeworkps.dll"
filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll")
Region:
id = 2386
start_va = 0x2400000
end_va = 0x24fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002400000"
filename = ""
Region:
id = 2387
start_va = 0x2500000
end_va = 0x25fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002500000"
filename = ""
Region:
id = 2388
start_va = 0x7ffd604e0000
end_va = 0x7ffd605c5fff
monitored = 0
entry_point = 0x7ffd604fcf10
region_type = mapped_file
name = "usermgr.dll"
filename = "\\Windows\\System32\\usermgr.dll" (normalized: "c:\\windows\\system32\\usermgr.dll")
Region:
id = 2389
start_va = 0x7ffd62430000
end_va = 0x7ffd62565fff
monitored = 0
entry_point = 0x7ffd6245f350
region_type = mapped_file
name = "wintypes.dll"
filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll")
Region:
id = 2390
start_va = 0x2600000
end_va = 0x26fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002600000"
filename = ""
Region:
id = 2391
start_va = 0x700000
end_va = 0x700fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000700000"
filename = ""
Region:
id = 2392
start_va = 0x700000
end_va = 0x700fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000700000"
filename = ""
Region:
id = 2395
start_va = 0x2700000
end_va = 0x27fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002700000"
filename = ""
Region:
id = 2396
start_va = 0x7ffd5ff70000
end_va = 0x7ffd5ff85fff
monitored = 0
entry_point = 0x7ffd5ff71b60
region_type = mapped_file
name = "wkscli.dll"
filename = "\\Windows\\System32\\wkscli.dll" (normalized: "c:\\windows\\system32\\wkscli.dll")
Region:
id = 2397
start_va = 0x2800000
end_va = 0x28fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002800000"
filename = ""
Region:
id = 2398
start_va = 0x7ffd5fc20000
end_va = 0x7ffd5fc60fff
monitored = 0
entry_point = 0x7ffd5fc24840
region_type = mapped_file
name = "usermgrproxy.dll"
filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll")
Region:
id = 2399
start_va = 0x7ffd5fb80000
end_va = 0x7ffd5fb92fff
monitored = 0
entry_point = 0x7ffd5fb857f0
region_type = mapped_file
name = "themeservice.dll"
filename = "\\Windows\\System32\\themeservice.dll" (normalized: "c:\\windows\\system32\\themeservice.dll")
Region:
id = 2400
start_va = 0x7ffd5ff40000
end_va = 0x7ffd5ff6dfff
monitored = 0
entry_point = 0x7ffd5ff47550
region_type = mapped_file
name = "netjoin.dll"
filename = "\\Windows\\System32\\netjoin.dll" (normalized: "c:\\windows\\system32\\netjoin.dll")
Region:
id = 2401
start_va = 0x7ffd66410000
end_va = 0x7ffd66430fff
monitored = 0
entry_point = 0x7ffd66420250
region_type = mapped_file
name = "joinutil.dll"
filename = "\\Windows\\System32\\joinutil.dll" (normalized: "c:\\windows\\system32\\joinutil.dll")
Region:
id = 2402
start_va = 0x7ffd5fb50000
end_va = 0x7ffd5fb6ffff
monitored = 0
entry_point = 0x7ffd5fb539a0
region_type = mapped_file
name = "locationwinpalmisc.dll"
filename = "\\Windows\\System32\\LocationWinPalMisc.dll" (normalized: "c:\\windows\\system32\\locationwinpalmisc.dll")
Region:
id = 2403
start_va = 0x7ffd65310000
end_va = 0x7ffd65336fff
monitored = 0
entry_point = 0x7ffd65317940
region_type = mapped_file
name = "devobj.dll"
filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")
Region:
id = 2404
start_va = 0x700000
end_va = 0x700fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000700000"
filename = ""
Region:
id = 2405
start_va = 0x7ffd5fb10000
end_va = 0x7ffd5fb46fff
monitored = 0
entry_point = 0x7ffd5fb16020
region_type = mapped_file
name = "gnssadapter.dll"
filename = "\\Windows\\System32\\GnssAdapter.dll" (normalized: "c:\\windows\\system32\\gnssadapter.dll")
Region:
id = 2406
start_va = 0x7ffd5fab0000
end_va = 0x7ffd5fb04fff
monitored = 0
entry_point = 0x7ffd5fab3fb0
region_type = mapped_file
name = "policymanager.dll"
filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll")
Region:
id = 2407
start_va = 0x710000
end_va = 0x710fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000710000"
filename = ""
Region:
id = 2408
start_va = 0x2900000
end_va = 0x29fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002900000"
filename = ""
Region:
id = 2409
start_va = 0x7ffd5fb70000
end_va = 0x7ffd5fb7bfff
monitored = 0
entry_point = 0x7ffd5fb72830
region_type = mapped_file
name = "bi.dll"
filename = "\\Windows\\System32\\bi.dll" (normalized: "c:\\windows\\system32\\bi.dll")
Region:
id = 2410
start_va = 0x7ffd5f990000
end_va = 0x7ffd5f9a9fff
monitored = 0
entry_point = 0x7ffd5f992cf0
region_type = mapped_file
name = "locationpelegacywinlocation.dll"
filename = "\\Windows\\System32\\LocationPeLegacyWinLocation.dll" (normalized: "c:\\windows\\system32\\locationpelegacywinlocation.dll")
Region:
id = 2411
start_va = 0x7ffd676b0000
end_va = 0x7ffd677f2fff
monitored = 0
entry_point = 0x7ffd676d8210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 2412
start_va = 0x2a00000
end_va = 0x2afffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002a00000"
filename = ""
Region:
id = 2413
start_va = 0x7ffd5f970000
end_va = 0x7ffd5f986fff
monitored = 0
entry_point = 0x7ffd5f975630
region_type = mapped_file
name = "sens.dll"
filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll")
Region:
id = 2414
start_va = 0x7ffd5f940000
end_va = 0x7ffd5f964fff
monitored = 0
entry_point = 0x7ffd5f952f20
region_type = mapped_file
name = "wificonnapi.dll"
filename = "\\Windows\\System32\\wificonnapi.dll" (normalized: "c:\\windows\\system32\\wificonnapi.dll")
Region:
id = 2415
start_va = 0x7ffd5f920000
end_va = 0x7ffd5f930fff
monitored = 0
entry_point = 0x7ffd5f927ea0
region_type = mapped_file
name = "dcpapi.dll"
filename = "\\Windows\\System32\\dcpapi.dll" (normalized: "c:\\windows\\system32\\dcpapi.dll")
Region:
id = 2416
start_va = 0x7ffd5f8e0000
end_va = 0x7ffd5f918fff
monitored = 0
entry_point = 0x7ffd5f8e9c90
region_type = mapped_file
name = "aepic.dll"
filename = "\\Windows\\System32\\aepic.dll" (normalized: "c:\\windows\\system32\\aepic.dll")
Region:
id = 2417
start_va = 0x7ffd5f8c0000
end_va = 0x7ffd5f8d0fff
monitored = 0
entry_point = 0x7ffd5f8c3e10
region_type = mapped_file
name = "sfc_os.dll"
filename = "\\Windows\\System32\\sfc_os.dll" (normalized: "c:\\windows\\system32\\sfc_os.dll")
Region:
id = 2418
start_va = 0x710000
end_va = 0x710fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000710000"
filename = ""
Region:
id = 2419
start_va = 0x7ffd620a0000
end_va = 0x7ffd62421fff
monitored = 0
entry_point = 0x7ffd620f1220
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")
Region:
id = 2420
start_va = 0x2b00000
end_va = 0x2cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002b00000"
filename = ""
Region:
id = 2421
start_va = 0x2b00000
end_va = 0x2bfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002b00000"
filename = ""
Region:
id = 2422
start_va = 0x7ffd5f860000
end_va = 0x7ffd5f910fff
monitored = 0
entry_point = 0x7ffd5f8d88b0
region_type = mapped_file
name = "cellularapi.dll"
filename = "\\Windows\\System32\\CellularAPI.dll" (normalized: "c:\\windows\\system32\\cellularapi.dll")
Region:
id = 2423
start_va = 0x7ffd5f840000
end_va = 0x7ffd5f851fff
monitored = 0
entry_point = 0x7ffd5f849260
region_type = mapped_file
name = "rilproxy.dll"
filename = "\\Windows\\System32\\rilproxy.dll" (normalized: "c:\\windows\\system32\\rilproxy.dll")
Region:
id = 2424
start_va = 0x7ffd5f790000
end_va = 0x7ffd5f83dfff
monitored = 0
entry_point = 0x7ffd5f7a80c0
region_type = mapped_file
name = "windows.networking.connectivity.dll"
filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll")
Region:
id = 2425
start_va = 0x7ffd65080000
end_va = 0x7ffd650b1fff
monitored = 0
entry_point = 0x7ffd6508b0c0
region_type = mapped_file
name = "shacct.dll"
filename = "\\Windows\\System32\\shacct.dll" (normalized: "c:\\windows\\system32\\shacct.dll")
Region:
id = 2426
start_va = 0x7ffd65060000
end_va = 0x7ffd6507bfff
monitored = 0
entry_point = 0x7ffd650637a0
region_type = mapped_file
name = "samlib.dll"
filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll")
Region:
id = 2427
start_va = 0x7ffd5f540000
end_va = 0x7ffd5f5dafff
monitored = 0
entry_point = 0x7ffd5f547220
region_type = mapped_file
name = "settingsync.dll"
filename = "\\Windows\\System32\\SettingSync.dll" (normalized: "c:\\windows\\system32\\settingsync.dll")
Region:
id = 2428
start_va = 0x720000
end_va = 0x721fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000720000"
filename = ""
Region:
id = 2429
start_va = 0x7ffd5fc70000
end_va = 0x7ffd5fcd3fff
monitored = 0
entry_point = 0x7ffd5fc85ae0
region_type = mapped_file
name = "wevtapi.dll"
filename = "\\Windows\\System32\\wevtapi.dll" (normalized: "c:\\windows\\system32\\wevtapi.dll")
Region:
id = 2430
start_va = 0x2200000
end_va = 0x22dffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")
Region:
id = 2431
start_va = 0x2c00000
end_va = 0x2cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002c00000"
filename = ""
Region:
id = 2438
start_va = 0x1440000
end_va = 0x14bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001440000"
filename = ""
Region:
id = 2439
start_va = 0x1d00000
end_va = 0x1dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001d00000"
filename = ""
Region:
id = 2440
start_va = 0x7ffd5f0c0000
end_va = 0x7ffd5f159fff
monitored = 0
entry_point = 0x7ffd5f0dada0
region_type = mapped_file
name = "shsvcs.dll"
filename = "\\Windows\\System32\\shsvcs.dll" (normalized: "c:\\windows\\system32\\shsvcs.dll")
Region:
id = 2441
start_va = 0x7ffd5efb0000
end_va = 0x7ffd5efc0fff
monitored = 0
entry_point = 0x7ffd5efb28d0
region_type = mapped_file
name = "credentialmigrationhandler.dll"
filename = "\\Windows\\System32\\CredentialMigrationHandler.dll" (normalized: "c:\\windows\\system32\\credentialmigrationhandler.dll")
Region:
id = 2442
start_va = 0x2a00000
end_va = 0x2afffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002a00000"
filename = ""
Region:
id = 2443
start_va = 0x1a40000
end_va = 0x1abffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001a40000"
filename = ""
Region:
id = 2444
start_va = 0x7ffd5f9b0000
end_va = 0x7ffd5fa6ffff
monitored = 0
entry_point = 0x7ffd5f9dfd20
region_type = mapped_file
name = "fveapi.dll"
filename = "\\Windows\\System32\\fveapi.dll" (normalized: "c:\\windows\\system32\\fveapi.dll")
Region:
id = 2445
start_va = 0x730000
end_va = 0x730fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000730000"
filename = ""
Region:
id = 2446
start_va = 0x7ffd5ef50000
end_va = 0x7ffd5efa1fff
monitored = 0
entry_point = 0x7ffd5ef538e0
region_type = mapped_file
name = "proximityservice.dll"
filename = "\\Windows\\System32\\ProximityService.dll" (normalized: "c:\\windows\\system32\\proximityservice.dll")
Region:
id = 2447
start_va = 0x7ffd5ef20000
end_va = 0x7ffd5ef4cfff
monitored = 0
entry_point = 0x7ffd5ef22290
region_type = mapped_file
name = "proximitycommon.dll"
filename = "\\Windows\\System32\\ProximityCommon.dll" (normalized: "c:\\windows\\system32\\proximitycommon.dll")
Region:
id = 2448
start_va = 0x7ffd5ef10000
end_va = 0x7ffd5ef18fff
monitored = 0
entry_point = 0x7ffd5ef11ed0
region_type = mapped_file
name = "proximitycommonpal.dll"
filename = "\\Windows\\System32\\ProximityCommonPal.dll" (normalized: "c:\\windows\\system32\\proximitycommonpal.dll")
Region:
id = 2449
start_va = 0x7ffd5fa70000
end_va = 0x7ffd5faa7fff
monitored = 0
entry_point = 0x7ffd5fa88cc0
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")
Region:
id = 2450
start_va = 0x7ffd5ef00000
end_va = 0x7ffd5ef0ffff
monitored = 0
entry_point = 0x7ffd5ef01700
region_type = mapped_file
name = "proximityservicepal.dll"
filename = "\\Windows\\System32\\ProximityServicePal.dll" (normalized: "c:\\windows\\system32\\proximityservicepal.dll")
Region:
id = 2451
start_va = 0x7ffd66960000
end_va = 0x7ffd669e5fff
monitored = 0
entry_point = 0x7ffd6696d8f0
region_type = mapped_file
name = "firewallapi.dll"
filename = "\\Windows\\System32\\FirewallAPI.dll" (normalized: "c:\\windows\\system32\\firewallapi.dll")
Region:
id = 2452
start_va = 0x7ffd65750000
end_va = 0x7ffd65781fff
monitored = 0
entry_point = 0x7ffd65762340
region_type = mapped_file
name = "fwbase.dll"
filename = "\\Windows\\System32\\fwbase.dll" (normalized: "c:\\windows\\system32\\fwbase.dll")
Region:
id = 2465
start_va = 0x2a00000
end_va = 0x2a7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002a00000"
filename = ""
Region:
id = 2466
start_va = 0x7ffd5fba0000
end_va = 0x7ffd5fc19fff
monitored = 0
entry_point = 0x7ffd5fbc7630
region_type = mapped_file
name = "es.dll"
filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")
Region:
id = 2467
start_va = 0x730000
end_va = 0x730fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000730000"
filename = ""
Region:
id = 2548
start_va = 0x7ffd66790000
end_va = 0x7ffd66828fff
monitored = 0
entry_point = 0x7ffd667bf4e0
region_type = mapped_file
name = "sxs.dll"
filename = "\\Windows\\System32\\sxs.dll" (normalized: "c:\\windows\\system32\\sxs.dll")
Region:
id = 2549
start_va = 0x730000
end_va = 0x731fff
monitored = 0
entry_point = 0x735630
region_type = mapped_file
name = "sens.dll"
filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll")
Region:
id = 2550
start_va = 0x7d0000
end_va = 0x7d4fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "stdole2.tlb"
filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb")
Region:
id = 2603
start_va = 0x2d00000
end_va = 0x2efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002d00000"
filename = ""
Region:
id = 2604
start_va = 0x2d00000
end_va = 0x2dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002d00000"
filename = ""
Region:
id = 2637
start_va = 0x7ffd5e8d0000
end_va = 0x7ffd5e8ddfff
monitored = 0
entry_point = 0x7ffd5e8d1460
region_type = mapped_file
name = "npmproxy.dll"
filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")
Region:
id = 2648
start_va = 0x730000
end_va = 0x730fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000730000"
filename = ""
Region:
id = 2649
start_va = 0x7ffd64ed0000
end_va = 0x7ffd65055fff
monitored = 0
entry_point = 0x7ffd64f1d700
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")
Region:
id = 2652
start_va = 0x730000
end_va = 0x733fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 2653
start_va = 0x10a0000
end_va = 0x10e4fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db")
Region:
id = 2654
start_va = 0x7d0000
end_va = 0x7d3fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 2655
start_va = 0x2e00000
end_va = 0x2e8dfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")
Region:
id = 2669
start_va = 0x7ffd658c0000
end_va = 0x7ffd658cbfff
monitored = 0
entry_point = 0x7ffd658c2790
region_type = mapped_file
name = "hid.dll"
filename = "\\Windows\\System32\\hid.dll" (normalized: "c:\\windows\\system32\\hid.dll")
Region:
id = 2693
start_va = 0x2e90000
end_va = 0x2f8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002e90000"
filename = ""
Region:
id = 2697
start_va = 0x7e0000
end_va = 0x7e1fff
monitored = 0
entry_point = 0x7e5630
region_type = mapped_file
name = "sens.dll"
filename = "\\Windows\\System32\\Sens.dll" (normalized: "c:\\windows\\system32\\sens.dll")
Region:
id = 2698
start_va = 0x7f0000
end_va = 0x7f4fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "stdole2.tlb"
filename = "\\Windows\\System32\\stdole2.tlb" (normalized: "c:\\windows\\system32\\stdole2.tlb")
Region:
id = 2750
start_va = 0x2a80000
end_va = 0x2afffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002a80000"
filename = ""
Region:
id = 2767
start_va = 0x7e0000
end_va = 0x7e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007e0000"
filename = ""
Region:
id = 2796
start_va = 0x7ffd5e730000
end_va = 0x7ffd5e773fff
monitored = 0
entry_point = 0x7ffd5e73c010
region_type = mapped_file
name = "execmodelclient.dll"
filename = "\\Windows\\System32\\ExecModelClient.dll" (normalized: "c:\\windows\\system32\\execmodelclient.dll")
Region:
id = 2797
start_va = 0x7ffd64290000
end_va = 0x7ffd6434dfff
monitored = 0
entry_point = 0x7ffd642d2d40
region_type = mapped_file
name = "coremessaging.dll"
filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll")
Region:
id = 2799
start_va = 0x7e0000
end_va = 0x7e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007e0000"
filename = ""
Region:
id = 2806
start_va = 0x7ffd64970000
end_va = 0x7ffd64e02fff
monitored = 0
entry_point = 0x7ffd6497f760
region_type = mapped_file
name = "actxprxy.dll"
filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")
Thread:
id = 158
os_tid = 0x35c
Thread:
id = 159
os_tid = 0x378
Thread:
id = 160
os_tid = 0x3c0
Thread:
id = 161
os_tid = 0x3f0
Thread:
id = 162
os_tid = 0x3fc
Thread:
id = 163
os_tid = 0x11c
Thread:
id = 164
os_tid = 0xf0
Thread:
id = 165
os_tid = 0x140
Thread:
id = 166
os_tid = 0x13c
Thread:
id = 167
os_tid = 0x150
Thread:
id = 168
os_tid = 0x14c
Thread:
id = 169
os_tid = 0x8
Thread:
id = 170
os_tid = 0x180
Thread:
id = 171
os_tid = 0x1c8
Thread:
id = 172
os_tid = 0x254
Thread:
id = 173
os_tid = 0x258
Thread:
id = 174
os_tid = 0x250
Thread:
id = 175
os_tid = 0x27c
Thread:
id = 176
os_tid = 0x280
Thread:
id = 177
os_tid = 0x2a8
Thread:
id = 178
os_tid = 0x3c0
Thread:
id = 179
os_tid = 0x168
Thread:
id = 180
os_tid = 0x420
Thread:
id = 181
os_tid = 0x454
Thread:
id = 182
os_tid = 0x4b0
Thread:
id = 183
os_tid = 0x4f8
Thread:
id = 184
os_tid = 0x530
Thread:
id = 201
os_tid = 0x474
Thread:
id = 205
os_tid = 0x504
Thread:
id = 219
os_tid = 0x5f8
Thread:
id = 224
os_tid = 0x644
Process:
id = "11"
image_name = "taskhostw.exe"
filename = "c:\\windows\\system32\\taskhostw.exe"
page_root = "0x61212000"
os_pid = "0x520"
os_integrity_level = "0x4000"
os_privileges = "0xe60b1e890"
monitor_reason = "child_process"
parent_id = "10"
os_parent_pid = "0x358"
cmd_line = "taskhostw.exe SYSTEM"
cur_dir = "C:\\Windows\\system32\\"
os_username = "NT AUTHORITY\\SYSTEM"
bitness = "32"
os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\BDESVC" [0xe], "NT SERVICE\\BITS" [0xa], "NT SERVICE\\CertPropSvc" [0xa], "NT SERVICE\\DcpSvc" [0xa], "NT SERVICE\\dmwappushservice" [0xa], "NT SERVICE\\DoSvc" [0xa], "NT SERVICE\\DsmSvc" [0xa], "NT SERVICE\\EapHost" [0xa], "NT SERVICE\\IKEEXT" [0xa], "NT SERVICE\\iphlpsvc" [0xa], "NT SERVICE\\LanmanServer" [0xa], "NT SERVICE\\lfsvc" [0xe], "NT SERVICE\\MSiSCSI" [0xa], "NT SERVICE\\NcaSvc" [0xa], "NT SERVICE\\NetSetupSvc" [0xa], "NT SERVICE\\RasAuto" [0xa], "NT SERVICE\\RasMan" [0xa], "NT SERVICE\\RemoteAccess" [0xa], "NT SERVICE\\RetailDemo" [0xa], "NT SERVICE\\Schedule" [0xe], "NT SERVICE\\SCPolicySvc" [0xa], "NT SERVICE\\SENS" [0xe], "NT SERVICE\\SessionEnv" [0xa], "NT SERVICE\\SharedAccess" [0xa], "NT SERVICE\\ShellHWDetection" [0xe], "NT SERVICE\\UsoSvc" [0xa], "NT SERVICE\\wercplsupport" [0xa], "NT SERVICE\\Winmgmt" [0xa], "NT SERVICE\\wlidsvc" [0xa], "NT SERVICE\\wuauserv" [0xa], "NT SERVICE\\XboxNetApiSvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000b1d9" [0xc0000007], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe]
Region:
id = 2453
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 2454
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 2455
start_va = 0x50000
end_va = 0xcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 2456
start_va = 0xd0000
end_va = 0xd3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 2457
start_va = 0xe0000
end_va = 0xe0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 2458
start_va = 0xf0000
end_va = 0xf1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000f0000"
filename = ""
Region:
id = 2459
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 2460
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 2461
start_va = 0x7df5fffc0000
end_va = 0x7df5fffe2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5fffc0000"
filename = ""
Region:
id = 2462
start_va = 0x7df5ffff0000
end_va = 0x7ff5fffeffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffff0000"
filename = ""
Region:
id = 2463
start_va = 0x7ff630810000
end_va = 0x7ff630828fff
monitored = 0
entry_point = 0x7ff6308159b0
region_type = mapped_file
name = "taskhostw.exe"
filename = "\\Windows\\System32\\taskhostw.exe" (normalized: "c:\\windows\\system32\\taskhostw.exe")
Region:
id = 2464
start_va = 0x7ffd6a2b0000
end_va = 0x7ffd6a470fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 2617
start_va = 0x100000
end_va = 0x1fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000100000"
filename = ""
Region:
id = 2618
start_va = 0x7ffd67820000
end_va = 0x7ffd678ccfff
monitored = 0
entry_point = 0x7ffd678381a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 2619
start_va = 0x7ffd66e20000
end_va = 0x7ffd67007fff
monitored = 0
entry_point = 0x7ffd66e4ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 2620
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 2621
start_va = 0x7df5ffec0000
end_va = 0x7df5fffbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffec0000"
filename = ""
Region:
id = 2622
start_va = 0x400000
end_va = 0x4bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 2623
start_va = 0x7ffd68590000
end_va = 0x7ffd6862cfff
monitored = 0
entry_point = 0x7ffd685978a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 2624
start_va = 0x4c0000
end_va = 0x53ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004c0000"
filename = ""
Region:
id = 2625
start_va = 0x7ffd67e70000
end_va = 0x7ffd67f8bfff
monitored = 0
entry_point = 0x7ffd67eb02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 2626
start_va = 0x7ffd68790000
end_va = 0x7ffd68a0cfff
monitored = 0
entry_point = 0x7ffd68864970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 2627
start_va = 0x7ffd66b20000
end_va = 0x7ffd66b89fff
monitored = 0
entry_point = 0x7ffd66b56d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 2628
start_va = 0x7ffd68060000
end_va = 0x7ffd68120fff
monitored = 0
entry_point = 0x7ffd68080da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 2629
start_va = 0x540000
end_va = 0x65ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000540000"
filename = ""
Region:
id = 2679
start_va = 0x20000
end_va = 0x26fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 2680
start_va = 0x660000
end_va = 0x7a2fff
monitored = 0
entry_point = 0x688210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 2681
start_va = 0x540000
end_va = 0x61cfff
monitored = 0
entry_point = 0x59e0b0
region_type = mapped_file
name = "rpcss.dll"
filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")
Region:
id = 2682
start_va = 0x650000
end_va = 0x65ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000650000"
filename = ""
Region:
id = 2683
start_va = 0x7ffd66950000
end_va = 0x7ffd6695efff
monitored = 0
entry_point = 0x7ffd66953210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 2684
start_va = 0x7ffd68630000
end_va = 0x7ffd68785fff
monitored = 0
entry_point = 0x7ffd6863a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 2685
start_va = 0x540000
end_va = 0x546fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000540000"
filename = ""
Region:
id = 2686
start_va = 0x7ffd68a10000
end_va = 0x7ffd68b95fff
monitored = 0
entry_point = 0x7ffd68a5ffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 2687
start_va = 0x660000
end_va = 0x7e7fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000660000"
filename = ""
Region:
id = 2688
start_va = 0x550000
end_va = 0x60ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000550000"
filename = ""
Region:
id = 2689
start_va = 0x7f0000
end_va = 0x970fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000007f0000"
filename = ""
Region:
id = 2779
start_va = 0x610000
end_va = 0x611fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000610000"
filename = ""
Region:
id = 2780
start_va = 0x620000
end_va = 0x620fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000620000"
filename = ""
Region:
id = 2781
start_va = 0x630000
end_va = 0x630fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "taskhostw.exe.mui"
filename = "\\Windows\\System32\\en-US\\taskhostw.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskhostw.exe.mui")
Region:
id = 2782
start_va = 0x640000
end_va = 0x640fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000640000"
filename = ""
Region:
id = 2783
start_va = 0x980000
end_va = 0x980fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000980000"
filename = ""
Region:
id = 2801
start_va = 0x7ffd683d0000
end_va = 0x7ffd6842afff
monitored = 0
entry_point = 0x7ffd683e38b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 3119
start_va = 0x990000
end_va = 0xa0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000990000"
filename = ""
Region:
id = 3120
start_va = 0xa10000
end_va = 0xa8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000a10000"
filename = ""
Region:
id = 3121
start_va = 0xa90000
end_va = 0xa90fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000a90000"
filename = ""
Region:
id = 3122
start_va = 0x7ffd67d10000
end_va = 0x7ffd67db6fff
monitored = 0
entry_point = 0x7ffd67d1b4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 3123
start_va = 0xaa0000
end_va = 0xaa0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000aa0000"
filename = ""
Region:
id = 3124
start_va = 0x7ffd65120000
end_va = 0x7ffd65130fff
monitored = 0
entry_point = 0x7ffd65126710
region_type = mapped_file
name = "tpmtasks.dll"
filename = "\\Windows\\System32\\TpmTasks.dll" (normalized: "c:\\windows\\system32\\tpmtasks.dll")
Region:
id = 3184
start_va = 0x7ffd67dc0000
end_va = 0x7ffd67e66fff
monitored = 0
entry_point = 0x7ffd67dd58d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 3185
start_va = 0x7ffd62f20000
end_va = 0x7ffd62f8dfff
monitored = 0
entry_point = 0x7ffd62f6e6c0
region_type = mapped_file
name = "tpmcoreprovisioning.dll"
filename = "\\Windows\\System32\\TpmCoreProvisioning.dll" (normalized: "c:\\windows\\system32\\tpmcoreprovisioning.dll")
Thread:
id = 206
os_tid = 0x524
Thread:
id = 217
os_tid = 0x598
Thread:
id = 277
os_tid = 0x738
Thread:
id = 278
os_tid = 0x734
Process:
id = "12"
image_name = "svchost.exe"
filename = "c:\\windows\\system32\\svchost.exe"
page_root = "0x68900000"
os_pid = "0x3ac"
os_integrity_level = "0x4000"
os_privileges = "0x60800000"
monitor_reason = "rpc_server"
parent_id = "10"
os_parent_pid = "0x210"
cmd_line = "C:\\Windows\\system32\\svchost.exe -k LocalService"
cur_dir = "C:\\Windows\\system32\\"
os_username = "NT AUTHORITY\\Local Service"
bitness = "32"
os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\AJRouter" [0xa], "NT SERVICE\\bthserv" [0xa], "NT SERVICE\\CDPSvc" [0xa], "NT SERVICE\\EventSystem" [0xa], "NT SERVICE\\fdPHost" [0xa], "NT SERVICE\\FontCache" [0xa], "NT SERVICE\\LicenseManager" [0xa], "NT SERVICE\\lltdsvc" [0xa], "NT SERVICE\\netprofm" [0xa], "NT SERVICE\\nsi" [0xa], "NT SERVICE\\PhoneSvc" [0xa], "NT SERVICE\\RemoteRegistry" [0xa], "NT SERVICE\\SstpSvc" [0xa], "NT SERVICE\\tzautoupdate" [0xe], "NT SERVICE\\W32Time" [0xa], "NT SERVICE\\WdiServiceHost" [0xa], "NT SERVICE\\WebClient" [0xa], "NT SERVICE\\WinHttpAutoProxySvc" [0xa], "NT SERVICE\\workfolderssvc" [0xa], "NT AUTHORITY\\Logon Session 00000000:0000cf1c" [0xc000000f], "LOCAL" [0x7]
Region:
id = 2468
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 2469
start_va = 0x20000
end_va = 0x21fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000020000"
filename = ""
Region:
id = 2470
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 2471
start_va = 0x50000
end_va = 0xcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 2472
start_va = 0xd0000
end_va = 0xd3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 2473
start_va = 0xe0000
end_va = 0xe0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 2474
start_va = 0xf0000
end_va = 0xf1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000f0000"
filename = ""
Region:
id = 2475
start_va = 0x100000
end_va = 0x1bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 2476
start_va = 0x1c0000
end_va = 0x1c0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001c0000"
filename = ""
Region:
id = 2477
start_va = 0x1d0000
end_va = 0x1d0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001d0000"
filename = ""
Region:
id = 2478
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001e0000"
filename = ""
Region:
id = 2479
start_va = 0x1f0000
end_va = 0x1f0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001f0000"
filename = ""
Region:
id = 2480
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 2481
start_va = 0x400000
end_va = 0x47ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 2482
start_va = 0x480000
end_va = 0x480fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000480000"
filename = ""
Region:
id = 2483
start_va = 0x490000
end_va = 0x490fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000490000"
filename = ""
Region:
id = 2484
start_va = 0x4a0000
end_va = 0x4e8fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "~fontcache-system.dat"
filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-System.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-system.dat")
Region:
id = 2485
start_va = 0x520000
end_va = 0x526fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000520000"
filename = ""
Region:
id = 2486
start_va = 0x530000
end_va = 0x5effff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000530000"
filename = ""
Region:
id = 2487
start_va = 0x600000
end_va = 0x6fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000600000"
filename = ""
Region:
id = 2488
start_va = 0x700000
end_va = 0x887fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000700000"
filename = ""
Region:
id = 2489
start_va = 0x8a0000
end_va = 0x8a6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000008a0000"
filename = ""
Region:
id = 2490
start_va = 0x900000
end_va = 0x9fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000900000"
filename = ""
Region:
id = 2491
start_va = 0xa00000
end_va = 0xb80fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000a00000"
filename = ""
Region:
id = 2492
start_va = 0xb90000
end_va = 0xf8afff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000b90000"
filename = ""
Region:
id = 2493
start_va = 0xf90000
end_va = 0x100ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000f90000"
filename = ""
Region:
id = 2494
start_va = 0x1010000
end_va = 0x110ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001010000"
filename = ""
Region:
id = 2495
start_va = 0x1120000
end_va = 0x1126fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001120000"
filename = ""
Region:
id = 2496
start_va = 0x1200000
end_va = 0x12fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001200000"
filename = ""
Region:
id = 2497
start_va = 0x1300000
end_va = 0x13fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001300000"
filename = ""
Region:
id = 2498
start_va = 0x1400000
end_va = 0x14fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001400000"
filename = ""
Region:
id = 2499
start_va = 0x1500000
end_va = 0x15fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001500000"
filename = ""
Region:
id = 2500
start_va = 0x1700000
end_va = 0x17fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001700000"
filename = ""
Region:
id = 2501
start_va = 0x1800000
end_va = 0x18fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001800000"
filename = ""
Region:
id = 2502
start_va = 0x1900000
end_va = 0x19fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001900000"
filename = ""
Region:
id = 2503
start_va = 0x1a00000
end_va = 0x29fffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "~fontcache-fontface.dat"
filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-FontFace.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-fontface.dat")
Region:
id = 2504
start_va = 0x2a00000
end_va = 0x2d36fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 2505
start_va = 0x2d40000
end_va = 0x353ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "~fontcache-s-1-5-18.dat"
filename = "\\Windows\\ServiceProfiles\\LocalService\\AppData\\Local\\FontCache\\~FontCache-S-1-5-18.dat" (normalized: "c:\\windows\\serviceprofiles\\localservice\\appdata\\local\\fontcache\\~fontcache-s-1-5-18.dat")
Region:
id = 2506
start_va = 0x3540000
end_va = 0x363ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003540000"
filename = ""
Region:
id = 2507
start_va = 0x3640000
end_va = 0x373ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003640000"
filename = ""
Region:
id = 2508
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 2509
start_va = 0x7df5ffec0000
end_va = 0x7df5fffbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffec0000"
filename = ""
Region:
id = 2510
start_va = 0x7df5fffc0000
end_va = 0x7df5fffe2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5fffc0000"
filename = ""
Region:
id = 2511
start_va = 0x7df5ffff0000
end_va = 0x7ff5fffeffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffff0000"
filename = ""
Region:
id = 2512
start_va = 0x7ff733e30000
end_va = 0x7ff733e3cfff
monitored = 0
entry_point = 0x7ff733e33980
region_type = mapped_file
name = "svchost.exe"
filename = "\\Windows\\System32\\svchost.exe" (normalized: "c:\\windows\\system32\\svchost.exe")
Region:
id = 2513
start_va = 0x7ffd5ee70000
end_va = 0x7ffd5eefafff
monitored = 0
entry_point = 0x7ffd5ee8d2a0
region_type = mapped_file
name = "netprofmsvc.dll"
filename = "\\Windows\\System32\\netprofmsvc.dll" (normalized: "c:\\windows\\system32\\netprofmsvc.dll")
Region:
id = 2514
start_va = 0x7ffd5f530000
end_va = 0x7ffd5f53cfff
monitored = 0
entry_point = 0x7ffd5f532650
region_type = mapped_file
name = "nsisvc.dll"
filename = "\\Windows\\System32\\nsisvc.dll" (normalized: "c:\\windows\\system32\\nsisvc.dll")
Region:
id = 2515
start_va = 0x7ffd5fba0000
end_va = 0x7ffd5fc19fff
monitored = 0
entry_point = 0x7ffd5fbc7630
region_type = mapped_file
name = "es.dll"
filename = "\\Windows\\System32\\es.dll" (normalized: "c:\\windows\\system32\\es.dll")
Region:
id = 2516
start_va = 0x7ffd605d0000
end_va = 0x7ffd605dbfff
monitored = 0
entry_point = 0x7ffd605d14d0
region_type = mapped_file
name = "locationframeworkps.dll"
filename = "\\Windows\\System32\\LocationFrameworkPS.dll" (normalized: "c:\\windows\\system32\\locationframeworkps.dll")
Region:
id = 2517
start_va = 0x7ffd60a50000
end_va = 0x7ffd60a78fff
monitored = 0
entry_point = 0x7ffd60a624d0
region_type = mapped_file
name = "fontprovider.dll"
filename = "\\Windows\\System32\\FontProvider.dll" (normalized: "c:\\windows\\system32\\fontprovider.dll")
Region:
id = 2518
start_va = 0x7ffd60a80000
end_va = 0x7ffd60c21fff
monitored = 0
entry_point = 0x7ffd60acc2d0
region_type = mapped_file
name = "fntcache.dll"
filename = "\\Windows\\System32\\FntCache.dll" (normalized: "c:\\windows\\system32\\fntcache.dll")
Region:
id = 2519
start_va = 0x7ffd60c80000
end_va = 0x7ffd60cc9fff
monitored = 0
entry_point = 0x7ffd60c8ac30
region_type = mapped_file
name = "deviceaccess.dll"
filename = "\\Windows\\System32\\deviceaccess.dll" (normalized: "c:\\windows\\system32\\deviceaccess.dll")
Region:
id = 2520
start_va = 0x7ffd60cd0000
end_va = 0x7ffd60d61fff
monitored = 0
entry_point = 0x7ffd60d1a780
region_type = mapped_file
name = "msvcp110_win.dll"
filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll")
Region:
id = 2521
start_va = 0x7ffd60d70000
end_va = 0x7ffd60da2fff
monitored = 0
entry_point = 0x7ffd60d7d5a0
region_type = mapped_file
name = "biwinrt.dll"
filename = "\\Windows\\System32\\biwinrt.dll" (normalized: "c:\\windows\\system32\\biwinrt.dll")
Region:
id = 2522
start_va = 0x7ffd60db0000
end_va = 0x7ffd60e28fff
monitored = 0
entry_point = 0x7ffd60dc7800
region_type = mapped_file
name = "geolocation.dll"
filename = "\\Windows\\System32\\Geolocation.dll" (normalized: "c:\\windows\\system32\\geolocation.dll")
Region:
id = 2523
start_va = 0x7ffd60e30000
end_va = 0x7ffd60e49fff
monitored = 0
entry_point = 0x7ffd60e3b670
region_type = mapped_file
name = "tzautoupdate.dll"
filename = "\\Windows\\System32\\tzautoupdate.dll" (normalized: "c:\\windows\\system32\\tzautoupdate.dll")
Region:
id = 2524
start_va = 0x7ffd61620000
end_va = 0x7ffd61655fff
monitored = 0
entry_point = 0x7ffd61630070
region_type = mapped_file
name = "xmllite.dll"
filename = "\\Windows\\System32\\xmllite.dll" (normalized: "c:\\windows\\system32\\xmllite.dll")
Region:
id = 2525
start_va = 0x7ffd63a70000
end_va = 0x7ffd63a87fff
monitored = 0
entry_point = 0x7ffd63a75910
region_type = mapped_file
name = "nlaapi.dll"
filename = "\\Windows\\System32\\nlaapi.dll" (normalized: "c:\\windows\\system32\\nlaapi.dll")
Region:
id = 2526
start_va = 0x7ffd653f0000
end_va = 0x7ffd654effff
monitored = 0
entry_point = 0x7ffd65430f80
region_type = mapped_file
name = "twinapi.appcore.dll"
filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll")
Region:
id = 2527
start_va = 0x7ffd65a70000
end_va = 0x7ffd65b63fff
monitored = 0
entry_point = 0x7ffd65a7a960
region_type = mapped_file
name = "ucrtbase.dll"
filename = "\\Windows\\System32\\ucrtbase.dll" (normalized: "c:\\windows\\system32\\ucrtbase.dll")
Region:
id = 2528
start_va = 0x7ffd66090000
end_va = 0x7ffd660aefff
monitored = 0
entry_point = 0x7ffd66095d30
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")
Region:
id = 2529
start_va = 0x7ffd66760000
end_va = 0x7ffd66788fff
monitored = 0
entry_point = 0x7ffd66774530
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 2530
start_va = 0x7ffd668d0000
end_va = 0x7ffd668e3fff
monitored = 0
entry_point = 0x7ffd668d52e0
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 2531
start_va = 0x7ffd66950000
end_va = 0x7ffd6695efff
monitored = 0
entry_point = 0x7ffd66953210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 2532
start_va = 0x7ffd66b20000
end_va = 0x7ffd66b89fff
monitored = 0
entry_point = 0x7ffd66b56d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 2533
start_va = 0x7ffd66b90000
end_va = 0x7ffd66c44fff
monitored = 0
entry_point = 0x7ffd66bd22e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 2534
start_va = 0x7ffd66e20000
end_va = 0x7ffd67007fff
monitored = 0
entry_point = 0x7ffd66e4ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 2535
start_va = 0x7ffd67820000
end_va = 0x7ffd678ccfff
monitored = 0
entry_point = 0x7ffd678381a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 2536
start_va = 0x7ffd67d10000
end_va = 0x7ffd67db6fff
monitored = 0
entry_point = 0x7ffd67d1b4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 2537
start_va = 0x7ffd67dc0000
end_va = 0x7ffd67e66fff
monitored = 0
entry_point = 0x7ffd67dd58d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 2538
start_va = 0x7ffd67e70000
end_va = 0x7ffd67f8bfff
monitored = 0
entry_point = 0x7ffd67eb02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 2539
start_va = 0x7ffd68060000
end_va = 0x7ffd68120fff
monitored = 0
entry_point = 0x7ffd68080da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 2540
start_va = 0x7ffd68350000
end_va = 0x7ffd68357fff
monitored = 0
entry_point = 0x7ffd68351ea0
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")
Region:
id = 2541
start_va = 0x7ffd683d0000
end_va = 0x7ffd6842afff
monitored = 0
entry_point = 0x7ffd683e38b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 2542
start_va = 0x7ffd68590000
end_va = 0x7ffd6862cfff
monitored = 0
entry_point = 0x7ffd685978a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 2543
start_va = 0x7ffd68630000
end_va = 0x7ffd68785fff
monitored = 0
entry_point = 0x7ffd6863a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 2544
start_va = 0x7ffd68790000
end_va = 0x7ffd68a0cfff
monitored = 0
entry_point = 0x7ffd68864970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 2545
start_va = 0x7ffd68a10000
end_va = 0x7ffd68b95fff
monitored = 0
entry_point = 0x7ffd68a5ffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 2546
start_va = 0x7ffd6a2b0000
end_va = 0x7ffd6a470fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 2547
start_va = 0x3740000
end_va = 0x383ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003740000"
filename = ""
Region:
id = 2551
start_va = 0x3840000
end_va = 0x393ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003840000"
filename = ""
Region:
id = 2612
start_va = 0x4f0000
end_va = 0x4f1fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "netprofmsvc.dll.mui"
filename = "\\Windows\\System32\\en-US\\netprofmsvc.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\netprofmsvc.dll.mui")
Region:
id = 2632
start_va = 0x3940000
end_va = 0x3a3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003940000"
filename = ""
Region:
id = 2633
start_va = 0x3a40000
end_va = 0x3b3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003a40000"
filename = ""
Region:
id = 2634
start_va = 0x3b40000
end_va = 0x3c3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003b40000"
filename = ""
Region:
id = 2635
start_va = 0x3c40000
end_va = 0x3d3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003c40000"
filename = ""
Region:
id = 2636
start_va = 0x7ffd5e8d0000
end_va = 0x7ffd5e8ddfff
monitored = 0
entry_point = 0x7ffd5e8d1460
region_type = mapped_file
name = "npmproxy.dll"
filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")
Region:
id = 2638
start_va = 0x7ffd676b0000
end_va = 0x7ffd677f2fff
monitored = 0
entry_point = 0x7ffd676d8210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 2641
start_va = 0x8b0000
end_va = 0x8ddfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000008b0000"
filename = ""
Region:
id = 2694
start_va = 0x3d40000
end_va = 0x3e3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003d40000"
filename = ""
Region:
id = 2695
start_va = 0x3f00000
end_va = 0x3ffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003f00000"
filename = ""
Region:
id = 2696
start_va = 0x7ffd60720000
end_va = 0x7ffd607e7fff
monitored = 0
entry_point = 0x7ffd607613f0
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")
Region:
id = 2699
start_va = 0x7ffd67f90000
end_va = 0x7ffd67ffafff
monitored = 0
entry_point = 0x7ffd67fa90c0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 2700
start_va = 0x7ffd66200000
end_va = 0x7ffd6625bfff
monitored = 0
entry_point = 0x7ffd66216f70
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")
Region:
id = 2701
start_va = 0x7ffd5fa70000
end_va = 0x7ffd5faa7fff
monitored = 0
entry_point = 0x7ffd5fa88cc0
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")
Region:
id = 2702
start_va = 0x7ffd5f230000
end_va = 0x7ffd5f23afff
monitored = 0
entry_point = 0x7ffd5f231d30
region_type = mapped_file
name = "winnsi.dll"
filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")
Region:
id = 2703
start_va = 0x7ffd66900000
end_va = 0x7ffd6694afff
monitored = 0
entry_point = 0x7ffd669035f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 2704
start_va = 0x4000000
end_va = 0x40fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004000000"
filename = ""
Region:
id = 2705
start_va = 0x7ffd5f2b0000
end_va = 0x7ffd5f2c5fff
monitored = 0
entry_point = 0x7ffd5f2b19f0
region_type = mapped_file
name = "dhcpcsvc6.dll"
filename = "\\Windows\\System32\\dhcpcsvc6.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc6.dll")
Region:
id = 2706
start_va = 0x7ffd5f290000
end_va = 0x7ffd5f2a9fff
monitored = 0
entry_point = 0x7ffd5f292430
region_type = mapped_file
name = "dhcpcsvc.dll"
filename = "\\Windows\\System32\\dhcpcsvc.dll" (normalized: "c:\\windows\\system32\\dhcpcsvc.dll")
Region:
id = 2707
start_va = 0x7ffd65340000
end_va = 0x7ffd653e9fff
monitored = 0
entry_point = 0x7ffd65367910
region_type = mapped_file
name = "dnsapi.dll"
filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")
Region:
id = 2708
start_va = 0x7ffd5e2f0000
end_va = 0x7ffd5e2f9fff
monitored = 0
entry_point = 0x7ffd5e2f14c0
region_type = mapped_file
name = "rasadhlp.dll"
filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")
Region:
id = 2709
start_va = 0x1600000
end_va = 0x16dffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")
Region:
id = 2710
start_va = 0x7ffd5e2d0000
end_va = 0x7ffd5e2e3fff
monitored = 0
entry_point = 0x7ffd5e2d1a50
region_type = mapped_file
name = "wlanradiomanager.dll"
filename = "\\Windows\\System32\\WlanRadioManager.dll" (normalized: "c:\\windows\\system32\\wlanradiomanager.dll")
Region:
id = 2712
start_va = 0x7ffd607f0000
end_va = 0x7ffd60850fff
monitored = 0
entry_point = 0x7ffd607f4b50
region_type = mapped_file
name = "wlanapi.dll"
filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll")
Region:
id = 2713
start_va = 0x7ffd67660000
end_va = 0x7ffd676a2fff
monitored = 0
entry_point = 0x7ffd67674b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 2714
start_va = 0x7ffd5e210000
end_va = 0x7ffd5e228fff
monitored = 0
entry_point = 0x7ffd5e212180
region_type = mapped_file
name = "bthradiomedia.dll"
filename = "\\Windows\\System32\\BthRadioMedia.dll" (normalized: "c:\\windows\\system32\\bthradiomedia.dll")
Region:
id = 2715
start_va = 0x7ffd65310000
end_va = 0x7ffd65336fff
monitored = 0
entry_point = 0x7ffd65317940
region_type = mapped_file
name = "devobj.dll"
filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")
Region:
id = 2716
start_va = 0x7ffd5e1f0000
end_va = 0x7ffd5e20dfff
monitored = 0
entry_point = 0x7ffd5e1f1690
region_type = mapped_file
name = "bluetoothapis.dll"
filename = "\\Windows\\System32\\BluetoothApis.dll" (normalized: "c:\\windows\\system32\\bluetoothapis.dll")
Region:
id = 2717
start_va = 0x7ffd658d0000
end_va = 0x7ffd658f3fff
monitored = 0
entry_point = 0x7ffd658d3260
region_type = mapped_file
name = "gpapi.dll"
filename = "\\Windows\\System32\\gpapi.dll" (normalized: "c:\\windows\\system32\\gpapi.dll")
Region:
id = 2866
start_va = 0x4100000
end_va = 0x41fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004100000"
filename = ""
Region:
id = 2867
start_va = 0x7ffd5c6d0000
end_va = 0x7ffd5c6dafff
monitored = 0
entry_point = 0x7ffd5c6d1a20
region_type = mapped_file
name = "licensemanagersvc.dll"
filename = "\\Windows\\System32\\LicenseManagerSvc.dll" (normalized: "c:\\windows\\system32\\licensemanagersvc.dll")
Region:
id = 2868
start_va = 0x7ffd66b90000
end_va = 0x7ffd66c44fff
monitored = 0
entry_point = 0x7ffd66bd22e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 2869
start_va = 0x7ffd5c590000
end_va = 0x7ffd5c6ccfff
monitored = 0
entry_point = 0x7ffd5c5aa6a0
region_type = mapped_file
name = "licensemanager.dll"
filename = "\\Windows\\System32\\LicenseManager.dll" (normalized: "c:\\windows\\system32\\licensemanager.dll")
Region:
id = 2870
start_va = 0x7ffd5c570000
end_va = 0x7ffd5c585fff
monitored = 0
entry_point = 0x7ffd5c57b550
region_type = mapped_file
name = "clipc.dll"
filename = "\\Windows\\System32\\Clipc.dll" (normalized: "c:\\windows\\system32\\clipc.dll")
Region:
id = 3078
start_va = 0x4200000
end_va = 0x42fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004200000"
filename = ""
Region:
id = 3097
start_va = 0x4300000
end_va = 0x43fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004300000"
filename = ""
Thread:
id = 185
os_tid = 0x538
Thread:
id = 186
os_tid = 0x41c
Thread:
id = 187
os_tid = 0x20c
Thread:
id = 188
os_tid = 0x1b0
Thread:
id = 189
os_tid = 0x1b4
Thread:
id = 190
os_tid = 0x16c
Thread:
id = 191
os_tid = 0x174
Thread:
id = 192
os_tid = 0x18c
Thread:
id = 193
os_tid = 0x3b4
Thread:
id = 194
os_tid = 0x3b0
Thread:
id = 195
os_tid = 0x544
Thread:
id = 196
os_tid = 0x548
Thread:
id = 197
os_tid = 0x54c
Thread:
id = 207
os_tid = 0x590
Thread:
id = 208
os_tid = 0x59c
Thread:
id = 209
os_tid = 0x5a0
Thread:
id = 210
os_tid = 0x5a4
Thread:
id = 218
os_tid = 0x5e4
Thread:
id = 220
os_tid = 0x60c
Thread:
id = 239
os_tid = 0x708
Thread:
id = 263
os_tid = 0x740
Thread:
id = 271
os_tid = 0x76c
Process:
id = "13"
image_name = "sihost.exe"
filename = "c:\\windows\\system32\\sihost.exe"
page_root = "0x6258a000"
os_pid = "0x558"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "child_process"
parent_id = "10"
os_parent_pid = "0x358"
cmd_line = "sihost.exe"
cur_dir = "C:\\Windows\\system32\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e694" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 2552
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 2553
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 2554
start_va = 0x50000
end_va = 0xcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 2555
start_va = 0xd0000
end_va = 0xd3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 2556
start_va = 0xe0000
end_va = 0xe1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000e0000"
filename = ""
Region:
id = 2557
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 2558
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 2559
start_va = 0x7df5fffc0000
end_va = 0x7df5fffe2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5fffc0000"
filename = ""
Region:
id = 2560
start_va = 0x7df5ffff0000
end_va = 0x7ff5fffeffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffff0000"
filename = ""
Region:
id = 2561
start_va = 0x7ff695bb0000
end_va = 0x7ff695bc5fff
monitored = 0
entry_point = 0x7ff695bb5190
region_type = mapped_file
name = "sihost.exe"
filename = "\\Windows\\System32\\sihost.exe" (normalized: "c:\\windows\\system32\\sihost.exe")
Region:
id = 2562
start_va = 0x7ffd6a2b0000
end_va = 0x7ffd6a470fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 2563
start_va = 0x400000
end_va = 0x68ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 2564
start_va = 0x7ffd67820000
end_va = 0x7ffd678ccfff
monitored = 0
entry_point = 0x7ffd678381a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 2565
start_va = 0x7ffd66e20000
end_va = 0x7ffd67007fff
monitored = 0
entry_point = 0x7ffd66e4ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 2566
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 2567
start_va = 0x7df5ffec0000
end_va = 0x7df5fffbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffec0000"
filename = ""
Region:
id = 2568
start_va = 0xf0000
end_va = 0x1adfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 2569
start_va = 0x7ffd68590000
end_va = 0x7ffd6862cfff
monitored = 0
entry_point = 0x7ffd685978a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 2570
start_va = 0x400000
end_va = 0x47ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 2571
start_va = 0x590000
end_va = 0x68ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000590000"
filename = ""
Region:
id = 2572
start_va = 0x7ffd68790000
end_va = 0x7ffd68a0cfff
monitored = 0
entry_point = 0x7ffd68864970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 2573
start_va = 0x7ffd67e70000
end_va = 0x7ffd67f8bfff
monitored = 0
entry_point = 0x7ffd67eb02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 2574
start_va = 0x7ffd66b20000
end_va = 0x7ffd66b89fff
monitored = 0
entry_point = 0x7ffd66b56d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 2575
start_va = 0x7ffd683d0000
end_va = 0x7ffd6842afff
monitored = 0
entry_point = 0x7ffd683e38b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 2576
start_va = 0x7ffd67dc0000
end_va = 0x7ffd67e66fff
monitored = 0
entry_point = 0x7ffd67dd58d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 2577
start_va = 0x20000
end_va = 0x26fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 2578
start_va = 0x7ffd65e20000
end_va = 0x7ffd65e50fff
monitored = 0
entry_point = 0x7ffd65e27d10
region_type = mapped_file
name = "ntmarta.dll"
filename = "\\Windows\\System32\\ntmarta.dll" (normalized: "c:\\windows\\system32\\ntmarta.dll")
Region:
id = 2579
start_va = 0x7ffd64290000
end_va = 0x7ffd6434dfff
monitored = 0
entry_point = 0x7ffd642d2d40
region_type = mapped_file
name = "coremessaging.dll"
filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll")
Region:
id = 2580
start_va = 0x7ffd5eab0000
end_va = 0x7ffd5ed37fff
monitored = 0
entry_point = 0x7ffd5eb0f670
region_type = mapped_file
name = "coreuicomponents.dll"
filename = "\\Windows\\System32\\CoreUIComponents.dll" (normalized: "c:\\windows\\system32\\coreuicomponents.dll")
Region:
id = 2581
start_va = 0x480000
end_va = 0x4fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000480000"
filename = ""
Region:
id = 2582
start_va = 0x7ffd66950000
end_va = 0x7ffd6695efff
monitored = 0
entry_point = 0x7ffd66953210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 2583
start_va = 0x7ffd68630000
end_va = 0x7ffd68785fff
monitored = 0
entry_point = 0x7ffd6863a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 2584
start_va = 0x7ffd68a10000
end_va = 0x7ffd68b95fff
monitored = 0
entry_point = 0x7ffd68a5ffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 2585
start_va = 0x7ffd66b90000
end_va = 0x7ffd66c44fff
monitored = 0
entry_point = 0x7ffd66bd22e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 2586
start_va = 0x7ffd62430000
end_va = 0x7ffd62565fff
monitored = 0
entry_point = 0x7ffd6245f350
region_type = mapped_file
name = "wintypes.dll"
filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll")
Region:
id = 2587
start_va = 0x690000
end_va = 0x81ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000690000"
filename = ""
Region:
id = 2588
start_va = 0x1b0000
end_va = 0x1b6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001b0000"
filename = ""
Region:
id = 2589
start_va = 0x1c0000
end_va = 0x1f8fff
monitored = 0
entry_point = 0x1c12f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 2590
start_va = 0x820000
end_va = 0x9a7fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000820000"
filename = ""
Region:
id = 2591
start_va = 0x7ffd6a270000
end_va = 0x7ffd6a2aafff
monitored = 0
entry_point = 0x7ffd6a2712f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 2592
start_va = 0x9b0000
end_va = 0xb30fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000009b0000"
filename = ""
Region:
id = 2593
start_va = 0xb40000
end_va = 0x1f3ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000b40000"
filename = ""
Region:
id = 2594
start_va = 0x1c0000
end_va = 0x1c0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 2595
start_va = 0x1d0000
end_va = 0x1d0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001d0000"
filename = ""
Region:
id = 2596
start_va = 0x690000
end_va = 0x76cfff
monitored = 0
entry_point = 0x6ee0b0
region_type = mapped_file
name = "rpcss.dll"
filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")
Region:
id = 2597
start_va = 0x810000
end_va = 0x81ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000810000"
filename = ""
Region:
id = 2598
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001e0000"
filename = ""
Region:
id = 2599
start_va = 0x7ffd67d10000
end_va = 0x7ffd67db6fff
monitored = 0
entry_point = 0x7ffd67d1b4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 2600
start_va = 0x1f0000
end_va = 0x1f0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001f0000"
filename = ""
Region:
id = 2601
start_va = 0x7ffd5ea90000
end_va = 0x7ffd5eaadfff
monitored = 0
entry_point = 0x7ffd5ea95340
region_type = mapped_file
name = "desktopshellext.dll"
filename = "\\Windows\\System32\\DesktopShellExt.dll" (normalized: "c:\\windows\\system32\\desktopshellext.dll")
Region:
id = 2602
start_va = 0x7ffd5ea70000
end_va = 0x7ffd5ea81fff
monitored = 0
entry_point = 0x7ffd5ea75110
region_type = mapped_file
name = "windows.shell.servicehostbuilder.dll"
filename = "\\Windows\\System32\\Windows.Shell.ServiceHostBuilder.dll" (normalized: "c:\\windows\\system32\\windows.shell.servicehostbuilder.dll")
Region:
id = 2605
start_va = 0x690000
end_va = 0x78ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000690000"
filename = ""
Region:
id = 2606
start_va = 0x1f40000
end_va = 0x201cfff
monitored = 0
entry_point = 0x1f9e0b0
region_type = mapped_file
name = "rpcss.dll"
filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")
Region:
id = 2607
start_va = 0x500000
end_va = 0x57ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000500000"
filename = ""
Region:
id = 2608
start_va = 0x790000
end_va = 0x80ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000790000"
filename = ""
Region:
id = 2609
start_va = 0x1f40000
end_va = 0x1fbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001f40000"
filename = ""
Region:
id = 2610
start_va = 0x7ffd64970000
end_va = 0x7ffd64e02fff
monitored = 0
entry_point = 0x7ffd6497f760
region_type = mapped_file
name = "actxprxy.dll"
filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")
Region:
id = 2611
start_va = 0x7ffd5e930000
end_va = 0x7ffd5ea09fff
monitored = 0
entry_point = 0x7ffd5e9803b0
region_type = mapped_file
name = "modernexecserver.dll"
filename = "\\Windows\\System32\\modernexecserver.dll" (normalized: "c:\\windows\\system32\\modernexecserver.dll")
Region:
id = 2613
start_va = 0x7ffd68060000
end_va = 0x7ffd68120fff
monitored = 0
entry_point = 0x7ffd68080da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 2614
start_va = 0x7ffd66900000
end_va = 0x7ffd6694afff
monitored = 0
entry_point = 0x7ffd669035f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 2615
start_va = 0x7ffd65650000
end_va = 0x7ffd65679fff
monitored = 0
entry_point = 0x7ffd65658b90
region_type = mapped_file
name = "rmclient.dll"
filename = "\\Windows\\System32\\rmclient.dll" (normalized: "c:\\windows\\system32\\rmclient.dll")
Region:
id = 2616
start_va = 0x7ffd5e8e0000
end_va = 0x7ffd5e92afff
monitored = 0
entry_point = 0x7ffd5e8f7b70
region_type = mapped_file
name = "veeventdispatcher.dll"
filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll")
Region:
id = 2630
start_va = 0x7ffd653f0000
end_va = 0x7ffd654effff
monitored = 0
entry_point = 0x7ffd65430f80
region_type = mapped_file
name = "twinapi.appcore.dll"
filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll")
Region:
id = 2631
start_va = 0x7ffd66760000
end_va = 0x7ffd66788fff
monitored = 0
entry_point = 0x7ffd66774530
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 2639
start_va = 0x7ffd60cd0000
end_va = 0x7ffd60d61fff
monitored = 0
entry_point = 0x7ffd60d1a780
region_type = mapped_file
name = "msvcp110_win.dll"
filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll")
Region:
id = 2640
start_va = 0x1fc0000
end_va = 0x2102fff
monitored = 0
entry_point = 0x1fe8210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 2642
start_va = 0x580000
end_va = 0x581fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000580000"
filename = ""
Region:
id = 2643
start_va = 0x1fc0000
end_va = 0x1fc0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001fc0000"
filename = ""
Region:
id = 2644
start_va = 0x1fd0000
end_va = 0x20affff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")
Region:
id = 2645
start_va = 0x20b0000
end_va = 0x212ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000020b0000"
filename = ""
Region:
id = 2646
start_va = 0x7ffd65250000
end_va = 0x7ffd652e5fff
monitored = 0
entry_point = 0x7ffd65275570
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 2647
start_va = 0x2130000
end_va = 0x21dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002130000"
filename = ""
Region:
id = 2650
start_va = 0x7ffd5e810000
end_va = 0x7ffd5e840fff
monitored = 0
entry_point = 0x7ffd5e813400
region_type = mapped_file
name = "clipboardserver.dll"
filename = "\\Windows\\System32\\ClipboardServer.dll" (normalized: "c:\\windows\\system32\\clipboardserver.dll")
Region:
id = 2651
start_va = 0x7ffd5e7b0000
end_va = 0x7ffd5e80cfff
monitored = 0
entry_point = 0x7ffd5e7c0080
region_type = mapped_file
name = "activationmanager.dll"
filename = "\\Windows\\System32\\ActivationManager.dll" (normalized: "c:\\windows\\system32\\activationmanager.dll")
Region:
id = 2656
start_va = 0x7ffd5e780000
end_va = 0x7ffd5e7a2fff
monitored = 0
entry_point = 0x7ffd5e783020
region_type = mapped_file
name = "appointmentactivation.dll"
filename = "\\Windows\\System32\\AppointmentActivation.dll" (normalized: "c:\\windows\\system32\\appointmentactivation.dll")
Region:
id = 2657
start_va = 0x2130000
end_va = 0x21affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002130000"
filename = ""
Region:
id = 2658
start_va = 0x21d0000
end_va = 0x21dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000021d0000"
filename = ""
Region:
id = 2659
start_va = 0x7ffd676b0000
end_va = 0x7ffd677f2fff
monitored = 0
entry_point = 0x7ffd676d8210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 2660
start_va = 0x7ffd5fc20000
end_va = 0x7ffd5fc60fff
monitored = 0
entry_point = 0x7ffd5fc24840
region_type = mapped_file
name = "usermgrproxy.dll"
filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll")
Region:
id = 2661
start_va = 0x21e0000
end_va = 0x225ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000021e0000"
filename = ""
Region:
id = 2662
start_va = 0x7ffd60c70000
end_va = 0x7ffd60c7ffff
monitored = 0
entry_point = 0x7ffd60c72c60
region_type = mapped_file
name = "usermgrcli.dll"
filename = "\\Windows\\System32\\usermgrcli.dll" (normalized: "c:\\windows\\system32\\usermgrcli.dll")
Region:
id = 2663
start_va = 0x2260000
end_va = 0x235ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002260000"
filename = ""
Region:
id = 2664
start_va = 0x2360000
end_va = 0x2b5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002360000"
filename = ""
Region:
id = 2665
start_va = 0x2b60000
end_va = 0x2bdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002b60000"
filename = ""
Region:
id = 2666
start_va = 0x2be0000
end_va = 0x2c5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002be0000"
filename = ""
Region:
id = 2667
start_va = 0x2c60000
end_va = 0x2cdffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002c60000"
filename = ""
Region:
id = 2668
start_va = 0x7ffd5e730000
end_va = 0x7ffd5e773fff
monitored = 0
entry_point = 0x7ffd5e73c010
region_type = mapped_file
name = "execmodelclient.dll"
filename = "\\Windows\\System32\\ExecModelClient.dll" (normalized: "c:\\windows\\system32\\execmodelclient.dll")
Region:
id = 2670
start_va = 0x7ffd5e720000
end_va = 0x7ffd5e72dfff
monitored = 0
entry_point = 0x7ffd5e722690
region_type = mapped_file
name = "notificationplatformcomponent.dll"
filename = "\\Windows\\System32\\notificationplatformcomponent.dll" (normalized: "c:\\windows\\system32\\notificationplatformcomponent.dll")
Region:
id = 2671
start_va = 0x7ffd5e680000
end_va = 0x7ffd5e716fff
monitored = 0
entry_point = 0x7ffd5e694fd0
region_type = mapped_file
name = "appcontracts.dll"
filename = "\\Windows\\System32\\AppContracts.dll" (normalized: "c:\\windows\\system32\\appcontracts.dll")
Region:
id = 2672
start_va = 0x7ffd5e5d0000
end_va = 0x7ffd5e671fff
monitored = 0
entry_point = 0x7ffd5e5d2b20
region_type = mapped_file
name = "sharehost.dll"
filename = "\\Windows\\System32\\ShareHost.dll" (normalized: "c:\\windows\\system32\\sharehost.dll")
Region:
id = 2673
start_va = 0x7ffd6a100000
end_va = 0x7ffd6a151fff
monitored = 0
entry_point = 0x7ffd6a10f530
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 2674
start_va = 0x7ffd67010000
end_va = 0x7ffd67653fff
monitored = 0
entry_point = 0x7ffd671d64b0
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")
Region:
id = 2675
start_va = 0x7ffd67660000
end_va = 0x7ffd676a2fff
monitored = 0
entry_point = 0x7ffd67674b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 2676
start_va = 0x7ffd668d0000
end_va = 0x7ffd668e3fff
monitored = 0
entry_point = 0x7ffd668d52e0
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 2677
start_va = 0x7ffd5e5c0000
end_va = 0x7ffd5e5c8fff
monitored = 0
entry_point = 0x7ffd5e5c1480
region_type = mapped_file
name = "wpportinglibrary.dll"
filename = "\\Windows\\System32\\WpPortingLibrary.dll" (normalized: "c:\\windows\\system32\\wpportinglibrary.dll")
Region:
id = 2678
start_va = 0x7ffd5e360000
end_va = 0x7ffd5e5bcfff
monitored = 0
entry_point = 0x7ffd5e3e8610
region_type = mapped_file
name = "twinui.appcore.dll"
filename = "\\Windows\\System32\\twinui.appcore.dll" (normalized: "c:\\windows\\system32\\twinui.appcore.dll")
Region:
id = 2711
start_va = 0x2ce0000
end_va = 0x2d5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002ce0000"
filename = ""
Region:
id = 2718
start_va = 0x7ffd5e0a0000
end_va = 0x7ffd5e0b4fff
monitored = 0
entry_point = 0x7ffd5e0a1ab0
region_type = mapped_file
name = "execmodelproxy.dll"
filename = "\\Windows\\System32\\execmodelproxy.dll" (normalized: "c:\\windows\\system32\\execmodelproxy.dll")
Region:
id = 2798
start_va = 0x2d60000
end_va = 0x2ddffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002d60000"
filename = ""
Region:
id = 2800
start_va = 0x2de0000
end_va = 0x2e5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002de0000"
filename = ""
Region:
id = 2802
start_va = 0x7ffd662b0000
end_va = 0x7ffd662c6fff
monitored = 0
entry_point = 0x7ffd662b79d0
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")
Region:
id = 2803
start_va = 0x7ffd65f40000
end_va = 0x7ffd65f73fff
monitored = 0
entry_point = 0x7ffd65f5ae70
region_type = mapped_file
name = "rsaenh.dll"
filename = "\\Windows\\System32\\rsaenh.dll" (normalized: "c:\\windows\\system32\\rsaenh.dll")
Region:
id = 2804
start_va = 0x2e60000
end_va = 0x3196fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 2805
start_va = 0x7ffd663d0000
end_va = 0x7ffd663dafff
monitored = 0
entry_point = 0x7ffd663d19a0
region_type = mapped_file
name = "cryptbase.dll"
filename = "\\Windows\\System32\\cryptbase.dll" (normalized: "c:\\windows\\system32\\cryptbase.dll")
Region:
id = 2807
start_va = 0x7ffd5daf0000
end_va = 0x7ffd5db00fff
monitored = 0
entry_point = 0x7ffd5daf5e90
region_type = mapped_file
name = "licensemanagerapi.dll"
filename = "\\Windows\\System32\\LicenseManagerApi.dll" (normalized: "c:\\windows\\system32\\licensemanagerapi.dll")
Region:
id = 3037
start_va = 0x31a0000
end_va = 0x321ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000031a0000"
filename = ""
Region:
id = 3038
start_va = 0x21b0000
end_va = 0x21b1fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep"
filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_x86__8wekyb3d8bbwe\\S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_1.10.22012.0_x86__8wekyb3d8bbwe\\s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep")
Region:
id = 3048
start_va = 0x3220000
end_va = 0x324dfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003220000"
filename = ""
Region:
id = 3049
start_va = 0x7df5ffe40000
end_va = 0x7df5ffebdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb")
Region:
id = 3050
start_va = 0x21b0000
end_va = 0x21b1fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep"
filename = "\\ProgramData\\Microsoft\\Windows\\AppRepository\\Packages\\Microsoft.Messaging_1.10.22012.0_x86__8wekyb3d8bbwe\\S-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep" (normalized: "c:\\programdata\\microsoft\\windows\\apprepository\\packages\\microsoft.messaging_1.10.22012.0_x86__8wekyb3d8bbwe\\s-1-5-21-1560258661-3990802383-1811730007-1000.pckgdep")
Region:
id = 3051
start_va = 0x7df5ffe40000
end_va = 0x7df5ffebdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sysmain.sdb"
filename = "\\Windows\\AppPatch\\apppatch64\\sysmain.sdb" (normalized: "c:\\windows\\apppatch\\apppatch64\\sysmain.sdb")
Thread:
id = 198
os_tid = 0x55c
Thread:
id = 199
os_tid = 0x56c
Thread:
id = 200
os_tid = 0x570
Thread:
id = 202
os_tid = 0x57c
Thread:
id = 203
os_tid = 0x584
Thread:
id = 204
os_tid = 0x588
Thread:
id = 211
os_tid = 0x5b8
Thread:
id = 212
os_tid = 0x5c0
Thread:
id = 213
os_tid = 0x5c4
Thread:
id = 214
os_tid = 0x5cc
Thread:
id = 215
os_tid = 0x5d0
Thread:
id = 216
os_tid = 0x5d4
Thread:
id = 221
os_tid = 0x610
Thread:
id = 230
os_tid = 0x678
Thread:
id = 231
os_tid = 0x694
Thread:
id = 257
os_tid = 0x71c
Process:
id = "14"
image_name = "taskhostw.exe"
filename = "c:\\windows\\system32\\taskhostw.exe"
page_root = "0x603e2000"
os_pid = "0x638"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "child_process"
parent_id = "10"
os_parent_pid = "0x358"
cmd_line = "taskhostw.exe"
cur_dir = "C:\\Windows\\system32\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e694" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 2719
start_va = 0x10000
end_va = 0x2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000010000"
filename = ""
Region:
id = 2720
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 2721
start_va = 0x50000
end_va = 0xcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 2722
start_va = 0xd0000
end_va = 0xd3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 2723
start_va = 0xe0000
end_va = 0xe0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 2724
start_va = 0xf0000
end_va = 0xf1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000f0000"
filename = ""
Region:
id = 2725
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 2726
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 2727
start_va = 0x7df5fffc0000
end_va = 0x7df5fffe2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5fffc0000"
filename = ""
Region:
id = 2728
start_va = 0x7df5ffff0000
end_va = 0x7ff5fffeffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffff0000"
filename = ""
Region:
id = 2729
start_va = 0x7ff630810000
end_va = 0x7ff630828fff
monitored = 0
entry_point = 0x7ff6308159b0
region_type = mapped_file
name = "taskhostw.exe"
filename = "\\Windows\\System32\\taskhostw.exe" (normalized: "c:\\windows\\system32\\taskhostw.exe")
Region:
id = 2730
start_va = 0x7ffd6a2b0000
end_va = 0x7ffd6a470fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 2731
start_va = 0x590000
end_va = 0x68ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000590000"
filename = ""
Region:
id = 2732
start_va = 0x7ffd66e20000
end_va = 0x7ffd67007fff
monitored = 0
entry_point = 0x7ffd66e4ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 2733
start_va = 0x7ffd67820000
end_va = 0x7ffd678ccfff
monitored = 0
entry_point = 0x7ffd678381a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 2734
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 2735
start_va = 0x7df5ffec0000
end_va = 0x7df5fffbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffec0000"
filename = ""
Region:
id = 2736
start_va = 0x100000
end_va = 0x1bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 2737
start_va = 0x7ffd68590000
end_va = 0x7ffd6862cfff
monitored = 0
entry_point = 0x7ffd685978a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 2738
start_va = 0x400000
end_va = 0x47ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 2739
start_va = 0x7ffd67e70000
end_va = 0x7ffd67f8bfff
monitored = 0
entry_point = 0x7ffd67eb02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 2740
start_va = 0x7ffd68790000
end_va = 0x7ffd68a0cfff
monitored = 0
entry_point = 0x7ffd68864970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 2741
start_va = 0x7ffd66b20000
end_va = 0x7ffd66b89fff
monitored = 0
entry_point = 0x7ffd66b56d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 2742
start_va = 0x7ffd68060000
end_va = 0x7ffd68120fff
monitored = 0
entry_point = 0x7ffd68080da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 2743
start_va = 0x480000
end_va = 0x56ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000480000"
filename = ""
Region:
id = 2744
start_va = 0x20000
end_va = 0x26fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 2745
start_va = 0x690000
end_va = 0x7d2fff
monitored = 0
entry_point = 0x6b8210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 2746
start_va = 0x480000
end_va = 0x55cfff
monitored = 0
entry_point = 0x4de0b0
region_type = mapped_file
name = "rpcss.dll"
filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")
Region:
id = 2747
start_va = 0x560000
end_va = 0x56ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000560000"
filename = ""
Region:
id = 2748
start_va = 0x7ffd66950000
end_va = 0x7ffd6695efff
monitored = 0
entry_point = 0x7ffd66953210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 2749
start_va = 0x1c0000
end_va = 0x1c6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 2751
start_va = 0x7ffd683d0000
end_va = 0x7ffd6842afff
monitored = 0
entry_point = 0x7ffd683e38b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 2752
start_va = 0x480000
end_va = 0x4fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000480000"
filename = ""
Region:
id = 2753
start_va = 0x7ffd68630000
end_va = 0x7ffd68785fff
monitored = 0
entry_point = 0x7ffd6863a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 2754
start_va = 0x7ffd68a10000
end_va = 0x7ffd68b95fff
monitored = 0
entry_point = 0x7ffd68a5ffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 2755
start_va = 0x500000
end_va = 0x538fff
monitored = 0
entry_point = 0x5012f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 2756
start_va = 0x690000
end_va = 0x817fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000690000"
filename = ""
Region:
id = 2757
start_va = 0x7ffd6a270000
end_va = 0x7ffd6a2aafff
monitored = 0
entry_point = 0x7ffd6a2712f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 2758
start_va = 0x820000
end_va = 0x9a0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000820000"
filename = ""
Region:
id = 2759
start_va = 0x9b0000
end_va = 0x1daffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000009b0000"
filename = ""
Region:
id = 2760
start_va = 0x1d0000
end_va = 0x1d1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001d0000"
filename = ""
Region:
id = 2761
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001e0000"
filename = ""
Region:
id = 2762
start_va = 0x1f0000
end_va = 0x1f0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "taskhostw.exe.mui"
filename = "\\Windows\\System32\\en-US\\taskhostw.exe.mui" (normalized: "c:\\windows\\system32\\en-us\\taskhostw.exe.mui")
Region:
id = 2763
start_va = 0x500000
end_va = 0x500fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000500000"
filename = ""
Region:
id = 2764
start_va = 0x510000
end_va = 0x510fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000510000"
filename = ""
Region:
id = 2765
start_va = 0x7ffd65250000
end_va = 0x7ffd652e5fff
monitored = 0
entry_point = 0x7ffd65275570
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 2766
start_va = 0x1db0000
end_va = 0x1f3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001db0000"
filename = ""
Region:
id = 2768
start_va = 0x7ffd68430000
end_va = 0x7ffd68589fff
monitored = 0
entry_point = 0x7ffd684738e0
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 2769
start_va = 0x520000
end_va = 0x520fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000520000"
filename = ""
Region:
id = 2770
start_va = 0x1db0000
end_va = 0x1e6bfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001db0000"
filename = ""
Region:
id = 2771
start_va = 0x1f30000
end_va = 0x1f3ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001f30000"
filename = ""
Region:
id = 2772
start_va = 0x520000
end_va = 0x523fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000520000"
filename = ""
Region:
id = 2773
start_va = 0x7ffd64150000
end_va = 0x7ffd64171fff
monitored = 0
entry_point = 0x7ffd64151a40
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")
Region:
id = 2774
start_va = 0x530000
end_va = 0x530fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000530000"
filename = ""
Region:
id = 2775
start_va = 0x1e70000
end_va = 0x1eeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001e70000"
filename = ""
Region:
id = 2776
start_va = 0x7ffd67d10000
end_va = 0x7ffd67db6fff
monitored = 0
entry_point = 0x7ffd67d1b4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 2777
start_va = 0x540000
end_va = 0x540fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000540000"
filename = ""
Region:
id = 2778
start_va = 0x7ffd5dcd0000
end_va = 0x7ffd5ddc8fff
monitored = 0
entry_point = 0x7ffd5dd18000
region_type = mapped_file
name = "settingsynccore.dll"
filename = "\\Windows\\System32\\SettingSyncCore.dll" (normalized: "c:\\windows\\system32\\settingsynccore.dll")
Region:
id = 2784
start_va = 0x550000
end_va = 0x551fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000550000"
filename = ""
Region:
id = 2785
start_va = 0x7ffd66b90000
end_va = 0x7ffd66c44fff
monitored = 0
entry_point = 0x7ffd66bd22e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 2786
start_va = 0x7ffd668d0000
end_va = 0x7ffd668e3fff
monitored = 0
entry_point = 0x7ffd668d52e0
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 2787
start_va = 0x7ffd67dc0000
end_va = 0x7ffd67e66fff
monitored = 0
entry_point = 0x7ffd67dd58d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 2788
start_va = 0x7ffd66760000
end_va = 0x7ffd66788fff
monitored = 0
entry_point = 0x7ffd66774530
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 2789
start_va = 0x7ffd662b0000
end_va = 0x7ffd662c6fff
monitored = 0
entry_point = 0x7ffd662b79d0
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")
Region:
id = 2790
start_va = 0x7ffd5dc00000
end_va = 0x7ffd5dccdfff
monitored = 0
entry_point = 0x7ffd5dc314c0
region_type = mapped_file
name = "tokenbroker.dll"
filename = "\\Windows\\System32\\TokenBroker.dll" (normalized: "c:\\windows\\system32\\tokenbroker.dll")
Region:
id = 2791
start_va = 0x7ffd62430000
end_va = 0x7ffd62565fff
monitored = 0
entry_point = 0x7ffd6245f350
region_type = mapped_file
name = "wintypes.dll"
filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll")
Region:
id = 2792
start_va = 0x1f40000
end_va = 0x201cfff
monitored = 0
entry_point = 0x1f9e0b0
region_type = mapped_file
name = "rpcss.dll"
filename = "\\Windows\\System32\\rpcss.dll" (normalized: "c:\\windows\\system32\\rpcss.dll")
Region:
id = 2793
start_va = 0x1f40000
end_va = 0x1fbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001f40000"
filename = ""
Region:
id = 2794
start_va = 0x1fc0000
end_va = 0x203ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001fc0000"
filename = ""
Region:
id = 2795
start_va = 0x2040000
end_va = 0x20bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002040000"
filename = ""
Region:
id = 2858
start_va = 0x7ffd64970000
end_va = 0x7ffd64e02fff
monitored = 0
entry_point = 0x7ffd6497f760
region_type = mapped_file
name = "actxprxy.dll"
filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")
Region:
id = 2859
start_va = 0x1ef0000
end_va = 0x1f1dfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001ef0000"
filename = ""
Region:
id = 3036
start_va = 0x7ffd5fc20000
end_va = 0x7ffd5fc60fff
monitored = 0
entry_point = 0x7ffd5fc24840
region_type = mapped_file
name = "usermgrproxy.dll"
filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll")
Thread:
id = 222
os_tid = 0x63c
Thread:
id = 223
os_tid = 0x640
Thread:
id = 225
os_tid = 0x650
Thread:
id = 226
os_tid = 0x654
Thread:
id = 227
os_tid = 0x65c
Thread:
id = 228
os_tid = 0x660
Thread:
id = 229
os_tid = 0x668
Process:
id = "15"
image_name = "runtimebroker.exe"
filename = "c:\\windows\\system32\\runtimebroker.exe"
page_root = "0x5f637000"
os_pid = "0x6b8"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "rpc_server"
parent_id = "14"
os_parent_pid = "0x26c"
cmd_line = "C:\\Windows\\System32\\RuntimeBroker.exe -Embedding"
cur_dir = "C:\\Windows\\system32\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e694" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 2808
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 2809
start_va = 0x20000
end_va = 0x20fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 2810
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 2811
start_va = 0x50000
end_va = 0xcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 2812
start_va = 0xd0000
end_va = 0xd3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 2813
start_va = 0xe0000
end_va = 0xe1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 2814
start_va = 0xf0000
end_va = 0xf1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000f0000"
filename = ""
Region:
id = 2815
start_va = 0x100000
end_va = 0x100fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000100000"
filename = ""
Region:
id = 2816
start_va = 0x110000
end_va = 0x110fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000110000"
filename = ""
Region:
id = 2817
start_va = 0x120000
end_va = 0x126fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000120000"
filename = ""
Region:
id = 2818
start_va = 0x130000
end_va = 0x1edfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 2819
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 2820
start_va = 0x400000
end_va = 0x4fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 2821
start_va = 0x500000
end_va = 0x57ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000500000"
filename = ""
Region:
id = 2822
start_va = 0x580000
end_va = 0x707fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000580000"
filename = ""
Region:
id = 2823
start_va = 0x740000
end_va = 0x746fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000740000"
filename = ""
Region:
id = 2824
start_va = 0x750000
end_va = 0x7cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000750000"
filename = ""
Region:
id = 2825
start_va = 0x800000
end_va = 0x8fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000800000"
filename = ""
Region:
id = 2826
start_va = 0x900000
end_va = 0xa80fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000900000"
filename = ""
Region:
id = 2827
start_va = 0xa90000
end_va = 0x1e8ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000a90000"
filename = ""
Region:
id = 2828
start_va = 0x1e90000
end_va = 0x1f0ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001e90000"
filename = ""
Region:
id = 2829
start_va = 0x1f10000
end_va = 0x1f8ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001f10000"
filename = ""
Region:
id = 2830
start_va = 0x1f90000
end_va = 0x200ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000001f90000"
filename = ""
Region:
id = 2831
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 2832
start_va = 0x7df5ffec0000
end_va = 0x7df5fffbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffec0000"
filename = ""
Region:
id = 2833
start_va = 0x7df5fffc0000
end_va = 0x7df5fffe2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5fffc0000"
filename = ""
Region:
id = 2834
start_va = 0x7df5ffff0000
end_va = 0x7ff5fffeffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffff0000"
filename = ""
Region:
id = 2835
start_va = 0x7ff6aa950000
end_va = 0x7ff6aa966fff
monitored = 0
entry_point = 0x7ff6aa9544f0
region_type = mapped_file
name = "runtimebroker.exe"
filename = "\\Windows\\System32\\RuntimeBroker.exe" (normalized: "c:\\windows\\system32\\runtimebroker.exe")
Region:
id = 2836
start_va = 0x7ffd66900000
end_va = 0x7ffd6694afff
monitored = 0
entry_point = 0x7ffd669035f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 2837
start_va = 0x7ffd66950000
end_va = 0x7ffd6695efff
monitored = 0
entry_point = 0x7ffd66953210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 2838
start_va = 0x7ffd66b20000
end_va = 0x7ffd66b89fff
monitored = 0
entry_point = 0x7ffd66b56d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 2839
start_va = 0x7ffd66e20000
end_va = 0x7ffd67007fff
monitored = 0
entry_point = 0x7ffd66e4ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 2840
start_va = 0x7ffd676b0000
end_va = 0x7ffd677f2fff
monitored = 0
entry_point = 0x7ffd676d8210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 2841
start_va = 0x7ffd67820000
end_va = 0x7ffd678ccfff
monitored = 0
entry_point = 0x7ffd678381a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 2842
start_va = 0x7ffd67d10000
end_va = 0x7ffd67db6fff
monitored = 0
entry_point = 0x7ffd67d1b4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 2843
start_va = 0x7ffd67e70000
end_va = 0x7ffd67f8bfff
monitored = 0
entry_point = 0x7ffd67eb02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 2844
start_va = 0x7ffd683d0000
end_va = 0x7ffd6842afff
monitored = 0
entry_point = 0x7ffd683e38b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 2845
start_va = 0x7ffd68590000
end_va = 0x7ffd6862cfff
monitored = 0
entry_point = 0x7ffd685978a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 2846
start_va = 0x7ffd68630000
end_va = 0x7ffd68785fff
monitored = 0
entry_point = 0x7ffd6863a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 2847
start_va = 0x7ffd68790000
end_va = 0x7ffd68a0cfff
monitored = 0
entry_point = 0x7ffd68864970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 2848
start_va = 0x7ffd68a10000
end_va = 0x7ffd68b95fff
monitored = 0
entry_point = 0x7ffd68a5ffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 2849
start_va = 0x7ffd6a270000
end_va = 0x7ffd6a2aafff
monitored = 0
entry_point = 0x7ffd6a2712f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 2850
start_va = 0x7ffd6a2b0000
end_va = 0x7ffd6a470fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 2851
start_va = 0x2010000
end_va = 0x208ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002010000"
filename = ""
Region:
id = 2852
start_va = 0x7ffd5dc00000
end_va = 0x7ffd5dccdfff
monitored = 0
entry_point = 0x7ffd5dc314c0
region_type = mapped_file
name = "tokenbroker.dll"
filename = "\\Windows\\System32\\TokenBroker.dll" (normalized: "c:\\windows\\system32\\tokenbroker.dll")
Region:
id = 2853
start_va = 0x7ffd62430000
end_va = 0x7ffd62565fff
monitored = 0
entry_point = 0x7ffd6245f350
region_type = mapped_file
name = "wintypes.dll"
filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll")
Region:
id = 2854
start_va = 0x7ffd66760000
end_va = 0x7ffd66788fff
monitored = 0
entry_point = 0x7ffd66774530
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 2855
start_va = 0x7ffd66b90000
end_va = 0x7ffd66c44fff
monitored = 0
entry_point = 0x7ffd66bd22e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 2856
start_va = 0x7ffd68060000
end_va = 0x7ffd68120fff
monitored = 0
entry_point = 0x7ffd68080da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 2857
start_va = 0x7ffd64970000
end_va = 0x7ffd64e02fff
monitored = 0
entry_point = 0x7ffd6497f760
region_type = mapped_file
name = "actxprxy.dll"
filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")
Region:
id = 2860
start_va = 0x7ffd650c0000
end_va = 0x7ffd650d2fff
monitored = 0
entry_point = 0x7ffd650c2760
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")
Region:
id = 2861
start_va = 0x1f0000
end_va = 0x1f0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001f0000"
filename = ""
Region:
id = 2862
start_va = 0x7ffd60000000
end_va = 0x7ffd60027fff
monitored = 0
entry_point = 0x7ffd60008c10
region_type = mapped_file
name = "idstore.dll"
filename = "\\Windows\\System32\\IDStore.dll" (normalized: "c:\\windows\\system32\\idstore.dll")
Region:
id = 2863
start_va = 0x7ffd67dc0000
end_va = 0x7ffd67e66fff
monitored = 0
entry_point = 0x7ffd67dd58d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 2864
start_va = 0x7ffd65060000
end_va = 0x7ffd6507bfff
monitored = 0
entry_point = 0x7ffd650637a0
region_type = mapped_file
name = "samlib.dll"
filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll")
Region:
id = 2865
start_va = 0x710000
end_va = 0x73dfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000710000"
filename = ""
Thread:
id = 232
os_tid = 0x6e4
Thread:
id = 233
os_tid = 0x6d4
Thread:
id = 234
os_tid = 0x6d0
Thread:
id = 235
os_tid = 0x6c4
Thread:
id = 236
os_tid = 0x6c0
Thread:
id = 237
os_tid = 0x6bc
Thread:
id = 238
os_tid = 0x6e8
Process:
id = "16"
image_name = "explorer.exe"
filename = "c:\\windows\\explorer.exe"
page_root = "0x60885000"
os_pid = "0x688"
os_integrity_level = "0x2000"
os_privileges = "0x800000"
monitor_reason = "rpc_server"
parent_id = "13"
os_parent_pid = "0x670"
cmd_line = "C:\\Windows\\Explorer.EXE"
cur_dir = "C:\\Windows\\system32\\"
os_username = "XC64ZB\\RDhJ0CNFevzX"
bitness = "32"
os_groups = "XC64ZB\\Domain Users" [0x7], "Everyone" [0x7], "NT AUTHORITY\\Local account and member of Administrators group" [0x10], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Local account" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e694" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7]
Region:
id = 2871
start_va = 0x10000
end_va = 0x1ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000010000"
filename = ""
Region:
id = 2872
start_va = 0x20000
end_va = 0x26fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000020000"
filename = ""
Region:
id = 2873
start_va = 0x30000
end_va = 0x44fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000030000"
filename = ""
Region:
id = 2874
start_va = 0x50000
end_va = 0xcffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000050000"
filename = ""
Region:
id = 2875
start_va = 0xd0000
end_va = 0xd3fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000d0000"
filename = ""
Region:
id = 2876
start_va = 0xe0000
end_va = 0xe1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000000e0000"
filename = ""
Region:
id = 2877
start_va = 0xf0000
end_va = 0xf1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000000f0000"
filename = ""
Region:
id = 2878
start_va = 0x100000
end_va = 0x1bdfff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "locale.nls"
filename = "\\Windows\\System32\\locale.nls" (normalized: "c:\\windows\\system32\\locale.nls")
Region:
id = 2879
start_va = 0x1c0000
end_va = 0x1c6fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001c0000"
filename = ""
Region:
id = 2880
start_va = 0x1d0000
end_va = 0x1d1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001d0000"
filename = ""
Region:
id = 2881
start_va = 0x1e0000
end_va = 0x1e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000001e0000"
filename = ""
Region:
id = 2882
start_va = 0x1f0000
end_va = 0x1f0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000001f0000"
filename = ""
Region:
id = 2883
start_va = 0x200000
end_va = 0x3fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000200000"
filename = ""
Region:
id = 2884
start_va = 0x400000
end_va = 0x47ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000400000"
filename = ""
Region:
id = 2885
start_va = 0x480000
end_va = 0x480fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000000480000"
filename = ""
Region:
id = 2886
start_va = 0x490000
end_va = 0x490fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000490000"
filename = ""
Region:
id = 2887
start_va = 0x4a0000
end_va = 0x4a0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004a0000"
filename = ""
Region:
id = 2888
start_va = 0x4b0000
end_va = 0x4bffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004b0000"
filename = ""
Region:
id = 2889
start_va = 0x4c0000
end_va = 0x4cffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004c0000"
filename = ""
Region:
id = 2890
start_va = 0x4d0000
end_va = 0x4d0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004d0000"
filename = ""
Region:
id = 2891
start_va = 0x4e0000
end_va = 0x4e0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000004e0000"
filename = ""
Region:
id = 2892
start_va = 0x4f0000
end_va = 0x5effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000004f0000"
filename = ""
Region:
id = 2893
start_va = 0x5f0000
end_va = 0x777fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000005f0000"
filename = ""
Region:
id = 2894
start_va = 0x780000
end_va = 0x900fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000780000"
filename = ""
Region:
id = 2895
start_va = 0x910000
end_va = 0x1d0ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000000910000"
filename = ""
Region:
id = 2896
start_va = 0x1d10000
end_va = 0x210afff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000001d10000"
filename = ""
Region:
id = 2897
start_va = 0x2110000
end_va = 0x2446fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "sortdefault.nls"
filename = "\\Windows\\Globalization\\Sorting\\SortDefault.nls" (normalized: "c:\\windows\\globalization\\sorting\\sortdefault.nls")
Region:
id = 2898
start_va = 0x2450000
end_va = 0x2453fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.1.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")
Region:
id = 2899
start_va = 0x2460000
end_va = 0x2476fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000d.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000000d.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x000000000000000d.db")
Region:
id = 2900
start_va = 0x2480000
end_va = 0x2480fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002480000"
filename = ""
Region:
id = 2901
start_va = 0x2490000
end_va = 0x24a7fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000000f.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x000000000000000f.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x000000000000000f.db")
Region:
id = 2902
start_va = 0x24b0000
end_va = 0x24b1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000024b0000"
filename = ""
Region:
id = 2903
start_va = 0x24c0000
end_va = 0x24c1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000024c0000"
filename = ""
Region:
id = 2904
start_va = 0x24d0000
end_va = 0x24fdfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000024d0000"
filename = ""
Region:
id = 2905
start_va = 0x2500000
end_va = 0x2501fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002500000"
filename = ""
Region:
id = 2906
start_va = 0x2510000
end_va = 0x258ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002510000"
filename = ""
Region:
id = 2907
start_va = 0x2590000
end_va = 0x260ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002590000"
filename = ""
Region:
id = 2908
start_va = 0x2610000
end_va = 0x268ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002610000"
filename = ""
Region:
id = 2909
start_va = 0x2690000
end_va = 0x270ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002690000"
filename = ""
Region:
id = 2910
start_va = 0x2710000
end_va = 0x27effff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "kernelbase.dll.mui"
filename = "\\Windows\\System32\\en-US\\KernelBase.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\kernelbase.dll.mui")
Region:
id = 2911
start_va = 0x27f0000
end_va = 0x286ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000027f0000"
filename = ""
Region:
id = 2912
start_va = 0x2870000
end_va = 0x28effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002870000"
filename = ""
Region:
id = 2913
start_va = 0x28f0000
end_va = 0x296ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000028f0000"
filename = ""
Region:
id = 2914
start_va = 0x2970000
end_va = 0x2971fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002970000"
filename = ""
Region:
id = 2915
start_va = 0x2980000
end_va = 0x2981fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "oleaccrc.dll"
filename = "\\Windows\\System32\\oleaccrc.dll" (normalized: "c:\\windows\\system32\\oleaccrc.dll")
Region:
id = 2916
start_va = 0x2990000
end_va = 0x2a4bfff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002990000"
filename = ""
Region:
id = 2917
start_va = 0x2a50000
end_va = 0x2a53fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002a50000"
filename = ""
Region:
id = 2918
start_va = 0x2a60000
end_va = 0x2b5ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002a60000"
filename = ""
Region:
id = 2919
start_va = 0x2b60000
end_va = 0x2b66fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000002b60000"
filename = ""
Region:
id = 2920
start_va = 0x2b70000
end_va = 0x2b71fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000002b70000"
filename = ""
Region:
id = 2921
start_va = 0x2b80000
end_va = 0x3bbffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "staticcache.dat"
filename = "\\Windows\\Fonts\\StaticCache.dat" (normalized: "c:\\windows\\fonts\\staticcache.dat")
Region:
id = 2922
start_va = 0x3bc0000
end_va = 0x3bc0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003bc0000"
filename = ""
Region:
id = 2923
start_va = 0x3bd0000
end_va = 0x3bd0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003bd0000"
filename = ""
Region:
id = 2924
start_va = 0x3be0000
end_va = 0x3be0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003be0000"
filename = ""
Region:
id = 2925
start_va = 0x3bf0000
end_va = 0x3bf1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003bf0000"
filename = ""
Region:
id = 2926
start_va = 0x3c00000
end_va = 0x3c7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003c00000"
filename = ""
Region:
id = 2927
start_va = 0x3c80000
end_va = 0x3c81fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003c80000"
filename = ""
Region:
id = 2928
start_va = 0x3c90000
end_va = 0x3c90fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003c90000"
filename = ""
Region:
id = 2929
start_va = 0x3ca0000
end_va = 0x3ca0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ca0000"
filename = ""
Region:
id = 2930
start_va = 0x3cb0000
end_va = 0x3cb0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003cb0000"
filename = ""
Region:
id = 2931
start_va = 0x3cc0000
end_va = 0x3dbffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003cc0000"
filename = ""
Region:
id = 2932
start_va = 0x3dc0000
end_va = 0x3dc0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003dc0000"
filename = ""
Region:
id = 2933
start_va = 0x3dd0000
end_va = 0x3ddffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003dd0000"
filename = ""
Region:
id = 2934
start_va = 0x3de0000
end_va = 0x3deffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003de0000"
filename = ""
Region:
id = 2935
start_va = 0x3df0000
end_va = 0x3dfffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003df0000"
filename = ""
Region:
id = 2936
start_va = 0x3e00000
end_va = 0x3e00fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003e00000"
filename = ""
Region:
id = 2937
start_va = 0x3e10000
end_va = 0x3e10fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003e10000"
filename = ""
Region:
id = 2938
start_va = 0x3e20000
end_va = 0x3e20fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003e20000"
filename = ""
Region:
id = 2939
start_va = 0x3e30000
end_va = 0x3e33fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.1.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")
Region:
id = 2940
start_va = 0x3e40000
end_va = 0x3e40fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003e40000"
filename = ""
Region:
id = 2941
start_va = 0x3e50000
end_va = 0x3e50fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003e50000"
filename = ""
Region:
id = 2942
start_va = 0x3e60000
end_va = 0x3e60fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003e60000"
filename = ""
Region:
id = 2943
start_va = 0x3e70000
end_va = 0x3e71fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003e70000"
filename = ""
Region:
id = 2944
start_va = 0x3e80000
end_va = 0x3eb8fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003e80000"
filename = ""
Region:
id = 2945
start_va = 0x3ec0000
end_va = 0x3ec0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ec0000"
filename = ""
Region:
id = 2946
start_va = 0x3ed0000
end_va = 0x3ed0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ed0000"
filename = ""
Region:
id = 2947
start_va = 0x3ef0000
end_va = 0x3f13fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ef0000"
filename = ""
Region:
id = 2948
start_va = 0x3f20000
end_va = 0x3f43fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003f20000"
filename = ""
Region:
id = 2949
start_va = 0x3f50000
end_va = 0x3f51fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003f50000"
filename = ""
Region:
id = 2950
start_va = 0x3f60000
end_va = 0x3f63fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 2951
start_va = 0x3f70000
end_va = 0x3fb4fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000005.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{6af0698e-d558-4f6e-9b3c-3716689af493}.2.ver0x0000000000000005.db")
Region:
id = 2952
start_va = 0x3fc0000
end_va = 0x3fc3fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 2953
start_va = 0x3fd0000
end_va = 0x405dfff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\{ddf571f2-be98-426d-8288-1a9a39c3fda2}.2.ver0x0000000000000001.db")
Region:
id = 2954
start_va = 0x4060000
end_va = 0x40dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004060000"
filename = ""
Region:
id = 2955
start_va = 0x40e0000
end_va = 0x415ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000040e0000"
filename = ""
Region:
id = 2956
start_va = 0x4160000
end_va = 0x41dffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004160000"
filename = ""
Region:
id = 2957
start_va = 0x41e0000
end_va = 0x41e0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000041e0000"
filename = ""
Region:
id = 2958
start_va = 0x4270000
end_va = 0x42effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004270000"
filename = ""
Region:
id = 2959
start_va = 0x42f0000
end_va = 0x436ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000042f0000"
filename = ""
Region:
id = 2960
start_va = 0x4370000
end_va = 0x43effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004370000"
filename = ""
Region:
id = 2961
start_va = 0x7ffe0000
end_va = 0x7ffeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x000000007ffe0000"
filename = ""
Region:
id = 2962
start_va = 0x7df5ffec0000
end_va = 0x7df5fffbffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffec0000"
filename = ""
Region:
id = 2963
start_va = 0x7df5fffc0000
end_va = 0x7df5fffe2fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5fffc0000"
filename = ""
Region:
id = 2964
start_va = 0x7df5ffff0000
end_va = 0x7ff5fffeffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00007df5ffff0000"
filename = ""
Region:
id = 2965
start_va = 0x7ff616dc0000
end_va = 0x7ff617207fff
monitored = 0
entry_point = 0x7ff616e5e090
region_type = mapped_file
name = "explorer.exe"
filename = "\\Windows\\explorer.exe" (normalized: "c:\\windows\\explorer.exe")
Region:
id = 2966
start_va = 0x7ffd5c6e0000
end_va = 0x7ffd5c6ebfff
monitored = 0
entry_point = 0x7ffd5c6e18b0
region_type = mapped_file
name = "wldp.dll"
filename = "\\Windows\\System32\\wldp.dll" (normalized: "c:\\windows\\system32\\wldp.dll")
Region:
id = 2967
start_va = 0x7ffd5c6f0000
end_va = 0x7ffd5c73cfff
monitored = 0
entry_point = 0x7ffd5c6fd180
region_type = mapped_file
name = "windows.immersiveshell.serviceprovider.dll"
filename = "\\Windows\\System32\\windows.immersiveshell.serviceprovider.dll" (normalized: "c:\\windows\\system32\\windows.immersiveshell.serviceprovider.dll")
Region:
id = 2968
start_va = 0x7ffd5c740000
end_va = 0x7ffd5d24afff
monitored = 0
entry_point = 0x7ffd5c88a540
region_type = mapped_file
name = "twinui.dll"
filename = "\\Windows\\System32\\twinui.dll" (normalized: "c:\\windows\\system32\\twinui.dll")
Region:
id = 2969
start_va = 0x7ffd5d250000
end_va = 0x7ffd5d29ffff
monitored = 0
entry_point = 0x7ffd5d252580
region_type = mapped_file
name = "edputil.dll"
filename = "\\Windows\\System32\\edputil.dll" (normalized: "c:\\windows\\system32\\edputil.dll")
Region:
id = 2970
start_va = 0x7ffd5d2a0000
end_va = 0x7ffd5d73ffff
monitored = 0
entry_point = 0x7ffd5d338740
region_type = mapped_file
name = "explorerframe.dll"
filename = "\\Windows\\System32\\ExplorerFrame.dll" (normalized: "c:\\windows\\system32\\explorerframe.dll")
Region:
id = 2971
start_va = 0x7ffd5d740000
end_va = 0x7ffd5d789fff
monitored = 0
entry_point = 0x7ffd5d745800
region_type = mapped_file
name = "dataexchange.dll"
filename = "\\Windows\\System32\\DataExchange.dll" (normalized: "c:\\windows\\system32\\dataexchange.dll")
Region:
id = 2972
start_va = 0x7ffd5d790000
end_va = 0x7ffd5d7f9fff
monitored = 0
entry_point = 0x7ffd5d7a5e90
region_type = mapped_file
name = "oleacc.dll"
filename = "\\Windows\\System32\\oleacc.dll" (normalized: "c:\\windows\\system32\\oleacc.dll")
Region:
id = 2973
start_va = 0x7ffd5d800000
end_va = 0x7ffd5d864fff
monitored = 0
entry_point = 0x7ffd5d804c50
region_type = mapped_file
name = "sndvolsso.dll"
filename = "\\Windows\\System32\\SndVolSSO.dll" (normalized: "c:\\windows\\system32\\sndvolsso.dll")
Region:
id = 2974
start_va = 0x7ffd5d870000
end_va = 0x7ffd5dae3fff
monitored = 0
entry_point = 0x7ffd5d8e0400
region_type = mapped_file
name = "comctl32.dll"
filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.10586.0_none_8c15ae12515e1c22\\comctl32.dll")
Region:
id = 2975
start_va = 0x7ffd5db10000
end_va = 0x7ffd5db24fff
monitored = 0
entry_point = 0x7ffd5db12c90
region_type = mapped_file
name = "settingsyncpolicy.dll"
filename = "\\Windows\\System32\\SettingSyncPolicy.dll" (normalized: "c:\\windows\\system32\\settingsyncpolicy.dll")
Region:
id = 2976
start_va = 0x7ffd5db30000
end_va = 0x7ffd5dbe0fff
monitored = 0
entry_point = 0x7ffd5db408f0
region_type = mapped_file
name = "twinapi.dll"
filename = "\\Windows\\System32\\twinapi.dll" (normalized: "c:\\windows\\system32\\twinapi.dll")
Region:
id = 2977
start_va = 0x7ffd5dc00000
end_va = 0x7ffd5dccdfff
monitored = 0
entry_point = 0x7ffd5dc314c0
region_type = mapped_file
name = "tokenbroker.dll"
filename = "\\Windows\\System32\\TokenBroker.dll" (normalized: "c:\\windows\\system32\\tokenbroker.dll")
Region:
id = 2978
start_va = 0x7ffd5dcd0000
end_va = 0x7ffd5ddc8fff
monitored = 0
entry_point = 0x7ffd5dd18000
region_type = mapped_file
name = "settingsynccore.dll"
filename = "\\Windows\\System32\\SettingSyncCore.dll" (normalized: "c:\\windows\\system32\\settingsynccore.dll")
Region:
id = 2979
start_va = 0x7ffd5f5e0000
end_va = 0x7ffd5f64ffff
monitored = 0
entry_point = 0x7ffd5f602960
region_type = mapped_file
name = "mmdevapi.dll"
filename = "\\Windows\\System32\\MMDevAPI.dll" (normalized: "c:\\windows\\system32\\mmdevapi.dll")
Region:
id = 2980
start_va = 0x7ffd5fab0000
end_va = 0x7ffd5fb04fff
monitored = 0
entry_point = 0x7ffd5fab3fb0
region_type = mapped_file
name = "policymanager.dll"
filename = "\\Windows\\System32\\policymanager.dll" (normalized: "c:\\windows\\system32\\policymanager.dll")
Region:
id = 2981
start_va = 0x7ffd5fc20000
end_va = 0x7ffd5fc60fff
monitored = 0
entry_point = 0x7ffd5fc24840
region_type = mapped_file
name = "usermgrproxy.dll"
filename = "\\Windows\\System32\\UserMgrProxy.dll" (normalized: "c:\\windows\\system32\\usermgrproxy.dll")
Region:
id = 2982
start_va = 0x7ffd60000000
end_va = 0x7ffd60027fff
monitored = 0
entry_point = 0x7ffd60008c10
region_type = mapped_file
name = "idstore.dll"
filename = "\\Windows\\System32\\IDStore.dll" (normalized: "c:\\windows\\system32\\idstore.dll")
Region:
id = 2983
start_va = 0x7ffd60cd0000
end_va = 0x7ffd60d61fff
monitored = 0
entry_point = 0x7ffd60d1a780
region_type = mapped_file
name = "msvcp110_win.dll"
filename = "\\Windows\\System32\\msvcp110_win.dll" (normalized: "c:\\windows\\system32\\msvcp110_win.dll")
Region:
id = 2984
start_va = 0x7ffd61ee0000
end_va = 0x7ffd6209cfff
monitored = 0
entry_point = 0x7ffd61f0af90
region_type = mapped_file
name = "windows.ui.immersive.dll"
filename = "\\Windows\\System32\\Windows.UI.Immersive.dll" (normalized: "c:\\windows\\system32\\windows.ui.immersive.dll")
Region:
id = 2985
start_va = 0x7ffd62430000
end_va = 0x7ffd62565fff
monitored = 0
entry_point = 0x7ffd6245f350
region_type = mapped_file
name = "wintypes.dll"
filename = "\\Windows\\System32\\WinTypes.dll" (normalized: "c:\\windows\\system32\\wintypes.dll")
Region:
id = 2986
start_va = 0x7ffd63660000
end_va = 0x7ffd6376dfff
monitored = 0
entry_point = 0x7ffd636aeaa0
region_type = mapped_file
name = "mrmcorer.dll"
filename = "\\Windows\\System32\\MrmCoreR.dll" (normalized: "c:\\windows\\system32\\mrmcorer.dll")
Region:
id = 2987
start_va = 0x7ffd63c30000
end_va = 0x7ffd63de0fff
monitored = 0
entry_point = 0x7ffd63cc61a0
region_type = mapped_file
name = "windowscodecs.dll"
filename = "\\Windows\\System32\\WindowsCodecs.dll" (normalized: "c:\\windows\\system32\\windowscodecs.dll")
Region:
id = 2988
start_va = 0x7ffd63df0000
end_va = 0x7ffd63e91fff
monitored = 0
entry_point = 0x7ffd63e10a40
region_type = mapped_file
name = "dxgi.dll"
filename = "\\Windows\\System32\\dxgi.dll" (normalized: "c:\\windows\\system32\\dxgi.dll")
Region:
id = 2989
start_va = 0x7ffd63ea0000
end_va = 0x7ffd64147fff
monitored = 0
entry_point = 0x7ffd63f33250
region_type = mapped_file
name = "d3d11.dll"
filename = "\\Windows\\System32\\d3d11.dll" (normalized: "c:\\windows\\system32\\d3d11.dll")
Region:
id = 2990
start_va = 0x7ffd64150000
end_va = 0x7ffd64171fff
monitored = 0
entry_point = 0x7ffd64151a40
region_type = mapped_file
name = "dwmapi.dll"
filename = "\\Windows\\System32\\dwmapi.dll" (normalized: "c:\\windows\\system32\\dwmapi.dll")
Region:
id = 2991
start_va = 0x7ffd64350000
end_va = 0x7ffd64432fff
monitored = 0
entry_point = 0x7ffd64387da0
region_type = mapped_file
name = "dcomp.dll"
filename = "\\Windows\\System32\\dcomp.dll" (normalized: "c:\\windows\\system32\\dcomp.dll")
Region:
id = 2992
start_va = 0x7ffd64740000
end_va = 0x7ffd647b8fff
monitored = 0
entry_point = 0x7ffd6475fb90
region_type = mapped_file
name = "apphelp.dll"
filename = "\\Windows\\System32\\apphelp.dll" (normalized: "c:\\windows\\system32\\apphelp.dll")
Region:
id = 2993
start_va = 0x7ffd64970000
end_va = 0x7ffd64e02fff
monitored = 0
entry_point = 0x7ffd6497f760
region_type = mapped_file
name = "actxprxy.dll"
filename = "\\Windows\\System32\\actxprxy.dll" (normalized: "c:\\windows\\system32\\actxprxy.dll")
Region:
id = 2994
start_va = 0x7ffd64e10000
end_va = 0x7ffd64e76fff
monitored = 0
entry_point = 0x7ffd64e2e710
region_type = mapped_file
name = "bcp47langs.dll"
filename = "\\Windows\\System32\\BCP47Langs.dll" (normalized: "c:\\windows\\system32\\bcp47langs.dll")
Region:
id = 2995
start_va = 0x7ffd64ed0000
end_va = 0x7ffd65055fff
monitored = 0
entry_point = 0x7ffd64f1d700
region_type = mapped_file
name = "propsys.dll"
filename = "\\Windows\\System32\\propsys.dll" (normalized: "c:\\windows\\system32\\propsys.dll")
Region:
id = 2996
start_va = 0x7ffd65060000
end_va = 0x7ffd6507bfff
monitored = 0
entry_point = 0x7ffd650637a0
region_type = mapped_file
name = "samlib.dll"
filename = "\\Windows\\System32\\samlib.dll" (normalized: "c:\\windows\\system32\\samlib.dll")
Region:
id = 2997
start_va = 0x7ffd650c0000
end_va = 0x7ffd650d2fff
monitored = 0
entry_point = 0x7ffd650c2760
region_type = mapped_file
name = "wtsapi32.dll"
filename = "\\Windows\\System32\\wtsapi32.dll" (normalized: "c:\\windows\\system32\\wtsapi32.dll")
Region:
id = 2998
start_va = 0x7ffd650e0000
end_va = 0x7ffd65104fff
monitored = 0
entry_point = 0x7ffd650e2300
region_type = mapped_file
name = "sppc.dll"
filename = "\\Windows\\System32\\sppc.dll" (normalized: "c:\\windows\\system32\\sppc.dll")
Region:
id = 2999
start_va = 0x7ffd65140000
end_va = 0x7ffd65164fff
monitored = 0
entry_point = 0x7ffd65155220
region_type = mapped_file
name = "slc.dll"
filename = "\\Windows\\System32\\slc.dll" (normalized: "c:\\windows\\system32\\slc.dll")
Region:
id = 3000
start_va = 0x7ffd65250000
end_va = 0x7ffd652e5fff
monitored = 0
entry_point = 0x7ffd65275570
region_type = mapped_file
name = "uxtheme.dll"
filename = "\\Windows\\System32\\uxtheme.dll" (normalized: "c:\\windows\\system32\\uxtheme.dll")
Region:
id = 3001
start_va = 0x7ffd65310000
end_va = 0x7ffd65336fff
monitored = 0
entry_point = 0x7ffd65317940
region_type = mapped_file
name = "devobj.dll"
filename = "\\Windows\\System32\\devobj.dll" (normalized: "c:\\windows\\system32\\devobj.dll")
Region:
id = 3002
start_va = 0x7ffd653f0000
end_va = 0x7ffd654effff
monitored = 0
entry_point = 0x7ffd65430f80
region_type = mapped_file
name = "twinapi.appcore.dll"
filename = "\\Windows\\System32\\twinapi.appcore.dll" (normalized: "c:\\windows\\system32\\twinapi.appcore.dll")
Region:
id = 3003
start_va = 0x7ffd65c40000
end_va = 0x7ffd65c95fff
monitored = 0
entry_point = 0x7ffd65c50bf0
region_type = mapped_file
name = "winsta.dll"
filename = "\\Windows\\System32\\winsta.dll" (normalized: "c:\\windows\\system32\\winsta.dll")
Region:
id = 3004
start_va = 0x7ffd66090000
end_va = 0x7ffd660aefff
monitored = 0
entry_point = 0x7ffd66095d30
region_type = mapped_file
name = "userenv.dll"
filename = "\\Windows\\System32\\userenv.dll" (normalized: "c:\\windows\\system32\\userenv.dll")
Region:
id = 3005
start_va = 0x7ffd662b0000
end_va = 0x7ffd662c6fff
monitored = 0
entry_point = 0x7ffd662b79d0
region_type = mapped_file
name = "cryptsp.dll"
filename = "\\Windows\\System32\\cryptsp.dll" (normalized: "c:\\windows\\system32\\cryptsp.dll")
Region:
id = 3006
start_va = 0x7ffd665b0000
end_va = 0x7ffd665dcfff
monitored = 0
entry_point = 0x7ffd665c9d40
region_type = mapped_file
name = "sspicli.dll"
filename = "\\Windows\\System32\\sspicli.dll" (normalized: "c:\\windows\\system32\\sspicli.dll")
Region:
id = 3007
start_va = 0x7ffd66760000
end_va = 0x7ffd66788fff
monitored = 0
entry_point = 0x7ffd66774530
region_type = mapped_file
name = "bcrypt.dll"
filename = "\\Windows\\System32\\bcrypt.dll" (normalized: "c:\\windows\\system32\\bcrypt.dll")
Region:
id = 3008
start_va = 0x7ffd668d0000
end_va = 0x7ffd668e3fff
monitored = 0
entry_point = 0x7ffd668d52e0
region_type = mapped_file
name = "profapi.dll"
filename = "\\Windows\\System32\\profapi.dll" (normalized: "c:\\windows\\system32\\profapi.dll")
Region:
id = 3009
start_va = 0x7ffd668f0000
end_va = 0x7ffd668fffff
monitored = 0
entry_point = 0x7ffd668f56e0
region_type = mapped_file
name = "msasn1.dll"
filename = "\\Windows\\System32\\msasn1.dll" (normalized: "c:\\windows\\system32\\msasn1.dll")
Region:
id = 3010
start_va = 0x7ffd66900000
end_va = 0x7ffd6694afff
monitored = 0
entry_point = 0x7ffd669035f0
region_type = mapped_file
name = "powrprof.dll"
filename = "\\Windows\\System32\\powrprof.dll" (normalized: "c:\\windows\\system32\\powrprof.dll")
Region:
id = 3011
start_va = 0x7ffd66950000
end_va = 0x7ffd6695efff
monitored = 0
entry_point = 0x7ffd66953210
region_type = mapped_file
name = "kernel.appcore.dll"
filename = "\\Windows\\System32\\kernel.appcore.dll" (normalized: "c:\\windows\\system32\\kernel.appcore.dll")
Region:
id = 3012
start_va = 0x7ffd66aa0000
end_va = 0x7ffd66af4fff
monitored = 0
entry_point = 0x7ffd66ab7970
region_type = mapped_file
name = "wintrust.dll"
filename = "\\Windows\\System32\\wintrust.dll" (normalized: "c:\\windows\\system32\\wintrust.dll")
Region:
id = 3013
start_va = 0x7ffd66b20000
end_va = 0x7ffd66b89fff
monitored = 0
entry_point = 0x7ffd66b56d50
region_type = mapped_file
name = "bcryptprimitives.dll"
filename = "\\Windows\\System32\\bcryptprimitives.dll" (normalized: "c:\\windows\\system32\\bcryptprimitives.dll")
Region:
id = 3014
start_va = 0x7ffd66b90000
end_va = 0x7ffd66c44fff
monitored = 0
entry_point = 0x7ffd66bd22e0
region_type = mapped_file
name = "shcore.dll"
filename = "\\Windows\\System32\\SHCore.dll" (normalized: "c:\\windows\\system32\\shcore.dll")
Region:
id = 3015
start_va = 0x7ffd66c50000
end_va = 0x7ffd66e16fff
monitored = 0
entry_point = 0x7ffd66cadb80
region_type = mapped_file
name = "crypt32.dll"
filename = "\\Windows\\System32\\crypt32.dll" (normalized: "c:\\windows\\system32\\crypt32.dll")
Region:
id = 3016
start_va = 0x7ffd66e20000
end_va = 0x7ffd67007fff
monitored = 0
entry_point = 0x7ffd66e4ba70
region_type = mapped_file
name = "kernelbase.dll"
filename = "\\Windows\\System32\\KernelBase.dll" (normalized: "c:\\windows\\system32\\kernelbase.dll")
Region:
id = 3017
start_va = 0x7ffd67010000
end_va = 0x7ffd67653fff
monitored = 0
entry_point = 0x7ffd671d64b0
region_type = mapped_file
name = "windows.storage.dll"
filename = "\\Windows\\System32\\windows.storage.dll" (normalized: "c:\\windows\\system32\\windows.storage.dll")
Region:
id = 3018
start_va = 0x7ffd67660000
end_va = 0x7ffd676a2fff
monitored = 0
entry_point = 0x7ffd67674b50
region_type = mapped_file
name = "cfgmgr32.dll"
filename = "\\Windows\\System32\\cfgmgr32.dll" (normalized: "c:\\windows\\system32\\cfgmgr32.dll")
Region:
id = 3019
start_va = 0x7ffd676b0000
end_va = 0x7ffd677f2fff
monitored = 0
entry_point = 0x7ffd676d8210
region_type = mapped_file
name = "ole32.dll"
filename = "\\Windows\\System32\\ole32.dll" (normalized: "c:\\windows\\system32\\ole32.dll")
Region:
id = 3020
start_va = 0x7ffd67820000
end_va = 0x7ffd678ccfff
monitored = 0
entry_point = 0x7ffd678381a0
region_type = mapped_file
name = "kernel32.dll"
filename = "\\Windows\\System32\\kernel32.dll" (normalized: "c:\\windows\\system32\\kernel32.dll")
Region:
id = 3021
start_va = 0x7ffd67d10000
end_va = 0x7ffd67db6fff
monitored = 0
entry_point = 0x7ffd67d1b4d0
region_type = mapped_file
name = "clbcatq.dll"
filename = "\\Windows\\System32\\clbcatq.dll" (normalized: "c:\\windows\\system32\\clbcatq.dll")
Region:
id = 3022
start_va = 0x7ffd67dc0000
end_va = 0x7ffd67e66fff
monitored = 0
entry_point = 0x7ffd67dd58d0
region_type = mapped_file
name = "advapi32.dll"
filename = "\\Windows\\System32\\advapi32.dll" (normalized: "c:\\windows\\system32\\advapi32.dll")
Region:
id = 3023
start_va = 0x7ffd67e70000
end_va = 0x7ffd67f8bfff
monitored = 0
entry_point = 0x7ffd67eb02b0
region_type = mapped_file
name = "rpcrt4.dll"
filename = "\\Windows\\System32\\rpcrt4.dll" (normalized: "c:\\windows\\system32\\rpcrt4.dll")
Region:
id = 3024
start_va = 0x7ffd68060000
end_va = 0x7ffd68120fff
monitored = 0
entry_point = 0x7ffd68080da0
region_type = mapped_file
name = "oleaut32.dll"
filename = "\\Windows\\System32\\oleaut32.dll" (normalized: "c:\\windows\\system32\\oleaut32.dll")
Region:
id = 3025
start_va = 0x7ffd682e0000
end_va = 0x7ffd6834efff
monitored = 0
entry_point = 0x7ffd68305f70
region_type = mapped_file
name = "coml2.dll"
filename = "\\Windows\\System32\\coml2.dll" (normalized: "c:\\windows\\system32\\coml2.dll")
Region:
id = 3026
start_va = 0x7ffd683d0000
end_va = 0x7ffd6842afff
monitored = 0
entry_point = 0x7ffd683e38b0
region_type = mapped_file
name = "sechost.dll"
filename = "\\Windows\\System32\\sechost.dll" (normalized: "c:\\windows\\system32\\sechost.dll")
Region:
id = 3027
start_va = 0x7ffd68430000
end_va = 0x7ffd68589fff
monitored = 0
entry_point = 0x7ffd684738e0
region_type = mapped_file
name = "msctf.dll"
filename = "\\Windows\\System32\\msctf.dll" (normalized: "c:\\windows\\system32\\msctf.dll")
Region:
id = 3028
start_va = 0x7ffd68590000
end_va = 0x7ffd6862cfff
monitored = 0
entry_point = 0x7ffd685978a0
region_type = mapped_file
name = "msvcrt.dll"
filename = "\\Windows\\System32\\msvcrt.dll" (normalized: "c:\\windows\\system32\\msvcrt.dll")
Region:
id = 3029
start_va = 0x7ffd68630000
end_va = 0x7ffd68785fff
monitored = 0
entry_point = 0x7ffd6863a8d0
region_type = mapped_file
name = "user32.dll"
filename = "\\Windows\\System32\\user32.dll" (normalized: "c:\\windows\\system32\\user32.dll")
Region:
id = 3030
start_va = 0x7ffd68790000
end_va = 0x7ffd68a0cfff
monitored = 0
entry_point = 0x7ffd68864970
region_type = mapped_file
name = "combase.dll"
filename = "\\Windows\\System32\\combase.dll" (normalized: "c:\\windows\\system32\\combase.dll")
Region:
id = 3031
start_va = 0x7ffd68a10000
end_va = 0x7ffd68b95fff
monitored = 0
entry_point = 0x7ffd68a5ffc0
region_type = mapped_file
name = "gdi32.dll"
filename = "\\Windows\\System32\\gdi32.dll" (normalized: "c:\\windows\\system32\\gdi32.dll")
Region:
id = 3032
start_va = 0x7ffd68ba0000
end_va = 0x7ffd6a0fefff
monitored = 0
entry_point = 0x7ffd68d011f0
region_type = mapped_file
name = "shell32.dll"
filename = "\\Windows\\System32\\shell32.dll" (normalized: "c:\\windows\\system32\\shell32.dll")
Region:
id = 3033
start_va = 0x7ffd6a100000
end_va = 0x7ffd6a151fff
monitored = 0
entry_point = 0x7ffd6a10f530
region_type = mapped_file
name = "shlwapi.dll"
filename = "\\Windows\\System32\\shlwapi.dll" (normalized: "c:\\windows\\system32\\shlwapi.dll")
Region:
id = 3034
start_va = 0x7ffd6a270000
end_va = 0x7ffd6a2aafff
monitored = 0
entry_point = 0x7ffd6a2712f0
region_type = mapped_file
name = "imm32.dll"
filename = "\\Windows\\System32\\imm32.dll" (normalized: "c:\\windows\\system32\\imm32.dll")
Region:
id = 3035
start_va = 0x7ffd6a2b0000
end_va = 0x7ffd6a470fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "ntdll.dll"
filename = "\\Windows\\System32\\ntdll.dll" (normalized: "c:\\windows\\system32\\ntdll.dll")
Region:
id = 3052
start_va = 0x3ee0000
end_va = 0x3ee6fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "transcodedwallpaper"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\themes\\transcodedwallpaper")
Region:
id = 3053
start_va = 0x43f0000
end_va = 0x48e1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000043f0000"
filename = ""
Region:
id = 3054
start_va = 0x3ee0000
end_va = 0x3ee5fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cachedimage_1440_900_pos4.jpg"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg")
Region:
id = 3055
start_va = 0x7ffd5fea0000
end_va = 0x7ffd5ff0cfff
monitored = 0
entry_point = 0x7ffd5fead750
region_type = mapped_file
name = "photometadatahandler.dll"
filename = "\\Windows\\System32\\PhotoMetadataHandler.dll" (normalized: "c:\\windows\\system32\\photometadatahandler.dll")
Region:
id = 3056
start_va = 0x48f0000
end_va = 0x4de1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000048f0000"
filename = ""
Region:
id = 3057
start_va = 0x7ffd5c490000
end_va = 0x7ffd5c56afff
monitored = 0
entry_point = 0x7ffd5c4a28b0
region_type = mapped_file
name = "ntshrui.dll"
filename = "\\Windows\\System32\\ntshrui.dll" (normalized: "c:\\windows\\system32\\ntshrui.dll")
Region:
id = 3058
start_va = 0x7ffd5c460000
end_va = 0x7ffd5c485fff
monitored = 0
entry_point = 0x7ffd5c461cf0
region_type = mapped_file
name = "srvcli.dll"
filename = "\\Windows\\System32\\srvcli.dll" (normalized: "c:\\windows\\system32\\srvcli.dll")
Region:
id = 3059
start_va = 0x4df0000
end_va = 0x4e6ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004df0000"
filename = ""
Region:
id = 3060
start_va = 0x7ffd5e360000
end_va = 0x7ffd5e5bcfff
monitored = 0
entry_point = 0x7ffd5e3e8610
region_type = mapped_file
name = "twinui.appcore.dll"
filename = "\\Windows\\System32\\twinui.appcore.dll" (normalized: "c:\\windows\\system32\\twinui.appcore.dll")
Region:
id = 3061
start_va = 0x7ffd64290000
end_va = 0x7ffd6434dfff
monitored = 0
entry_point = 0x7ffd642d2d40
region_type = mapped_file
name = "coremessaging.dll"
filename = "\\Windows\\System32\\CoreMessaging.dll" (normalized: "c:\\windows\\system32\\coremessaging.dll")
Region:
id = 3062
start_va = 0x7ffd5eab0000
end_va = 0x7ffd5ed37fff
monitored = 0
entry_point = 0x7ffd5eb0f670
region_type = mapped_file
name = "coreuicomponents.dll"
filename = "\\Windows\\System32\\CoreUIComponents.dll" (normalized: "c:\\windows\\system32\\coreuicomponents.dll")
Region:
id = 3063
start_va = 0x7ffd5c340000
end_va = 0x7ffd5c45ffff
monitored = 0
entry_point = 0x7ffd5c378310
region_type = mapped_file
name = "applicationframe.dll"
filename = "\\Windows\\System32\\ApplicationFrame.dll" (normalized: "c:\\windows\\system32\\applicationframe.dll")
Region:
id = 3064
start_va = 0x7ffd61660000
end_va = 0x7ffd61ba4fff
monitored = 0
entry_point = 0x7ffd617fa450
region_type = mapped_file
name = "d2d1.dll"
filename = "\\Windows\\System32\\d2d1.dll" (normalized: "c:\\windows\\system32\\d2d1.dll")
Region:
id = 3065
start_va = 0x4e70000
end_va = 0x4eeffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004e70000"
filename = ""
Region:
id = 3066
start_va = 0x4ef0000
end_va = 0x56effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004ef0000"
filename = ""
Region:
id = 3067
start_va = 0x56f0000
end_va = 0x576ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000056f0000"
filename = ""
Region:
id = 3068
start_va = 0x7ffd5c260000
end_va = 0x7ffd5c339fff
monitored = 0
entry_point = 0x7ffd5c293c00
region_type = mapped_file
name = "wpncore.dll"
filename = "\\Windows\\System32\\wpncore.dll" (normalized: "c:\\windows\\system32\\wpncore.dll")
Region:
id = 3069
start_va = 0x7ffd60720000
end_va = 0x7ffd607e7fff
monitored = 0
entry_point = 0x7ffd607613f0
region_type = mapped_file
name = "winhttp.dll"
filename = "\\Windows\\System32\\winhttp.dll" (normalized: "c:\\windows\\system32\\winhttp.dll")
Region:
id = 3070
start_va = 0x7ffd5c1d0000
end_va = 0x7ffd5c255fff
monitored = 0
entry_point = 0x7ffd5c1f1e10
region_type = mapped_file
name = "notificationcontroller.dll"
filename = "\\Windows\\System32\\NotificationController.dll" (normalized: "c:\\windows\\system32\\notificationcontroller.dll")
Region:
id = 3071
start_va = 0x7ffd5e8e0000
end_va = 0x7ffd5e92afff
monitored = 0
entry_point = 0x7ffd5e8f7b70
region_type = mapped_file
name = "veeventdispatcher.dll"
filename = "\\Windows\\System32\\VEEventDispatcher.dll" (normalized: "c:\\windows\\system32\\veeventdispatcher.dll")
Region:
id = 3072
start_va = 0x5770000
end_va = 0x586ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000005770000"
filename = ""
Region:
id = 3073
start_va = 0x3ee0000
end_va = 0x3f28fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000003ee0000"
filename = ""
Region:
id = 3074
start_va = 0x5870000
end_va = 0x7bf1fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "appdb.dat"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Notifications\\appdb.dat" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\notifications\\appdb.dat")
Region:
id = 3075
start_va = 0x7ffd5c1a0000
end_va = 0x7ffd5c1cafff
monitored = 0
entry_point = 0x7ffd5c1a4240
region_type = mapped_file
name = "abovelockapphost.dll"
filename = "\\Windows\\System32\\AboveLockAppHost.dll" (normalized: "c:\\windows\\system32\\abovelockapphost.dll")
Region:
id = 3076
start_va = 0x7c00000
end_va = 0x7c7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c00000"
filename = ""
Region:
id = 3077
start_va = 0x7ffd5c170000
end_va = 0x7ffd5c195fff
monitored = 0
entry_point = 0x7ffd5c185cb0
region_type = mapped_file
name = "npsm.dll"
filename = "\\Windows\\System32\\NPSM.dll" (normalized: "c:\\windows\\system32\\npsm.dll")
Region:
id = 3079
start_va = 0x7c80000
end_va = 0x7cfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007c80000"
filename = ""
Region:
id = 3080
start_va = 0x7d00000
end_va = 0x7d7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007d00000"
filename = ""
Region:
id = 3081
start_va = 0x3f30000
end_va = 0x3f3ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003f30000"
filename = ""
Region:
id = 3082
start_va = 0x3f30000
end_va = 0x3f3ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003f30000"
filename = ""
Region:
id = 3083
start_va = 0x3f30000
end_va = 0x3f3ffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000003f30000"
filename = ""
Region:
id = 3084
start_va = 0x7d80000
end_va = 0x7dfffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007d80000"
filename = ""
Region:
id = 3085
start_va = 0x7ffd5e0a0000
end_va = 0x7ffd5e0b4fff
monitored = 0
entry_point = 0x7ffd5e0a1ab0
region_type = mapped_file
name = "execmodelproxy.dll"
filename = "\\Windows\\System32\\execmodelproxy.dll" (normalized: "c:\\windows\\system32\\execmodelproxy.dll")
Region:
id = 3086
start_va = 0x7e00000
end_va = 0x7e7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007e00000"
filename = ""
Region:
id = 3087
start_va = 0x7e80000
end_va = 0x7efffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007e80000"
filename = ""
Region:
id = 3088
start_va = 0x7ffd5f790000
end_va = 0x7ffd5f83dfff
monitored = 0
entry_point = 0x7ffd5f7a80c0
region_type = mapped_file
name = "windows.networking.connectivity.dll"
filename = "\\Windows\\System32\\Windows.Networking.Connectivity.dll" (normalized: "c:\\windows\\system32\\windows.networking.connectivity.dll")
Region:
id = 3089
start_va = 0x7f00000
end_va = 0x7f7ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f00000"
filename = ""
Region:
id = 3090
start_va = 0x7f80000
end_va = 0x7ffffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000007f80000"
filename = ""
Region:
id = 3091
start_va = 0x7ffd65220000
end_va = 0x7ffd6522bfff
monitored = 0
entry_point = 0x7ffd652214b0
region_type = mapped_file
name = "notificationcontrollerps.dll"
filename = "\\Windows\\System32\\NotificationControllerPS.dll" (normalized: "c:\\windows\\system32\\notificationcontrollerps.dll")
Region:
id = 3092
start_va = 0x7ffd5e8d0000
end_va = 0x7ffd5e8ddfff
monitored = 0
entry_point = 0x7ffd5e8d1460
region_type = mapped_file
name = "npmproxy.dll"
filename = "\\Windows\\System32\\npmproxy.dll" (normalized: "c:\\windows\\system32\\npmproxy.dll")
Region:
id = 3093
start_va = 0x7ffd5fa70000
end_va = 0x7ffd5faa7fff
monitored = 0
entry_point = 0x7ffd5fa88cc0
region_type = mapped_file
name = "iphlpapi.dll"
filename = "\\Windows\\System32\\IPHLPAPI.DLL" (normalized: "c:\\windows\\system32\\iphlpapi.dll")
Region:
id = 3094
start_va = 0x7ffd68350000
end_va = 0x7ffd68357fff
monitored = 0
entry_point = 0x7ffd68351ea0
region_type = mapped_file
name = "nsi.dll"
filename = "\\Windows\\System32\\nsi.dll" (normalized: "c:\\windows\\system32\\nsi.dll")
Region:
id = 3095
start_va = 0x7ffd607f0000
end_va = 0x7ffd60850fff
monitored = 0
entry_point = 0x7ffd607f4b50
region_type = mapped_file
name = "wlanapi.dll"
filename = "\\Windows\\System32\\wlanapi.dll" (normalized: "c:\\windows\\system32\\wlanapi.dll")
Region:
id = 3096
start_va = 0x7ffd65200000
end_va = 0x7ffd65215fff
monitored = 0
entry_point = 0x7ffd65201d50
region_type = mapped_file
name = "wwapi.dll"
filename = "\\Windows\\System32\\wwapi.dll" (normalized: "c:\\windows\\system32\\wwapi.dll")
Region:
id = 3098
start_va = 0x7ffd651d0000
end_va = 0x7ffd651f1fff
monitored = 0
entry_point = 0x7ffd651d2580
region_type = mapped_file
name = "wcmapi.dll"
filename = "\\Windows\\System32\\wcmapi.dll" (normalized: "c:\\windows\\system32\\wcmapi.dll")
Region:
id = 3099
start_va = 0x7ffd65650000
end_va = 0x7ffd65679fff
monitored = 0
entry_point = 0x7ffd65658b90
region_type = mapped_file
name = "rmclient.dll"
filename = "\\Windows\\System32\\rmclient.dll" (normalized: "c:\\windows\\system32\\rmclient.dll")
Region:
id = 3100
start_va = 0x7ffd67f90000
end_va = 0x7ffd67ffafff
monitored = 0
entry_point = 0x7ffd67fa90c0
region_type = mapped_file
name = "ws2_32.dll"
filename = "\\Windows\\System32\\ws2_32.dll" (normalized: "c:\\windows\\system32\\ws2_32.dll")
Region:
id = 3101
start_va = 0x7ffd5ed40000
end_va = 0x7ffd5ed54fff
monitored = 0
entry_point = 0x7ffd5ed42dc0
region_type = mapped_file
name = "ondemandconnroutehelper.dll"
filename = "\\Windows\\System32\\OnDemandConnRouteHelper.dll" (normalized: "c:\\windows\\system32\\ondemandconnroutehelper.dll")
Region:
id = 3102
start_va = 0x7ffd5e850000
end_va = 0x7ffd5e8cffff
monitored = 0
entry_point = 0x7ffd5e87d280
region_type = mapped_file
name = "webio.dll"
filename = "\\Windows\\System32\\webio.dll" (normalized: "c:\\windows\\system32\\webio.dll")
Region:
id = 3103
start_va = 0x7ffd66200000
end_va = 0x7ffd6625bfff
monitored = 0
entry_point = 0x7ffd66216f70
region_type = mapped_file
name = "mswsock.dll"
filename = "\\Windows\\System32\\mswsock.dll" (normalized: "c:\\windows\\system32\\mswsock.dll")
Region:
id = 3104
start_va = 0x7ffd5f230000
end_va = 0x7ffd5f23afff
monitored = 0
entry_point = 0x7ffd5f231d30
region_type = mapped_file
name = "winnsi.dll"
filename = "\\Windows\\System32\\winnsi.dll" (normalized: "c:\\windows\\system32\\winnsi.dll")
Region:
id = 3105
start_va = 0x7ffd5ed60000
end_va = 0x7ffd5ed71fff
monitored = 0
entry_point = 0x7ffd5ed63580
region_type = mapped_file
name = "cscapi.dll"
filename = "\\Windows\\System32\\cscapi.dll" (normalized: "c:\\windows\\system32\\cscapi.dll")
Region:
id = 3106
start_va = 0x8000000
end_va = 0x807ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008000000"
filename = ""
Region:
id = 3107
start_va = 0x3f30000
end_va = 0x3f34fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "winnlsres.dll"
filename = "\\Windows\\System32\\winnlsres.dll" (normalized: "c:\\windows\\system32\\winnlsres.dll")
Region:
id = 3108
start_va = 0x3f40000
end_va = 0x3f4ffff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "winnlsres.dll.mui"
filename = "\\Windows\\System32\\en-US\\winnlsres.dll.mui" (normalized: "c:\\windows\\system32\\en-us\\winnlsres.dll.mui")
Region:
id = 3109
start_va = 0x7ffd65340000
end_va = 0x7ffd653e9fff
monitored = 0
entry_point = 0x7ffd65367910
region_type = mapped_file
name = "dnsapi.dll"
filename = "\\Windows\\System32\\dnsapi.dll" (normalized: "c:\\windows\\system32\\dnsapi.dll")
Region:
id = 3110
start_va = 0x7ffd5e2f0000
end_va = 0x7ffd5e2f9fff
monitored = 0
entry_point = 0x7ffd5e2f14c0
region_type = mapped_file
name = "rasadhlp.dll"
filename = "\\Windows\\System32\\rasadhlp.dll" (normalized: "c:\\windows\\system32\\rasadhlp.dll")
Region:
id = 3111
start_va = 0x7ffd5f170000
end_va = 0x7ffd5f1d6fff
monitored = 0
entry_point = 0x7ffd5f1763e0
region_type = mapped_file
name = "fwpuclnt.dll"
filename = "\\Windows\\System32\\FWPUCLNT.DLL" (normalized: "c:\\windows\\system32\\fwpuclnt.dll")
Region:
id = 3112
start_va = 0x8080000
end_va = 0x80fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008080000"
filename = ""
Region:
id = 3113
start_va = 0x8100000
end_va = 0x817ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008100000"
filename = ""
Region:
id = 3114
start_va = 0x7ffd648d0000
end_va = 0x7ffd64966fff
monitored = 0
entry_point = 0x7ffd648dddc0
region_type = mapped_file
name = "wlidprov.dll"
filename = "\\Windows\\System32\\wlidprov.dll" (normalized: "c:\\windows\\system32\\wlidprov.dll")
Region:
id = 3115
start_va = 0x8180000
end_va = 0x81fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008180000"
filename = ""
Region:
id = 3116
start_va = 0x8200000
end_va = 0x827ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008200000"
filename = ""
Region:
id = 3117
start_va = 0x7ffd65170000
end_va = 0x7ffd651cbfff
monitored = 0
entry_point = 0x7ffd65187190
region_type = mapped_file
name = "ninput.dll"
filename = "\\Windows\\System32\\ninput.dll" (normalized: "c:\\windows\\system32\\ninput.dll")
Region:
id = 3118
start_va = 0x7ffd61bb0000
end_va = 0x7ffd61e1efff
monitored = 0
entry_point = 0x7ffd61c622b0
region_type = mapped_file
name = "d3d10warp.dll"
filename = "\\Windows\\System32\\d3d10warp.dll" (normalized: "c:\\windows\\system32\\d3d10warp.dll")
Region:
id = 3125
start_va = 0x41f0000
end_va = 0x41f0fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000041f0000"
filename = ""
Region:
id = 3126
start_va = 0x4200000
end_va = 0x4200fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004200000"
filename = ""
Region:
id = 3127
start_va = 0x4210000
end_va = 0x4210fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004210000"
filename = ""
Region:
id = 3128
start_va = 0x8280000
end_va = 0x82fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008280000"
filename = ""
Region:
id = 3129
start_va = 0x8300000
end_va = 0x84fffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008300000"
filename = ""
Region:
id = 3130
start_va = 0x7ffd63be0000
end_va = 0x7ffd63c2afff
monitored = 0
entry_point = 0x7ffd63bf72b0
region_type = mapped_file
name = "uianimation.dll"
filename = "\\Windows\\System32\\UIAnimation.dll" (normalized: "c:\\windows\\system32\\uianimation.dll")
Region:
id = 3131
start_va = 0x8500000
end_va = 0x857ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008500000"
filename = ""
Region:
id = 3132
start_va = 0x4220000
end_va = 0x4221fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004220000"
filename = ""
Region:
id = 3133
start_va = 0x7ffd65e80000
end_va = 0x7ffd65ef9fff
monitored = 0
entry_point = 0x7ffd65ea1a50
region_type = mapped_file
name = "schannel.dll"
filename = "\\Windows\\System32\\schannel.dll" (normalized: "c:\\windows\\system32\\schannel.dll")
Region:
id = 3134
start_va = 0x4230000
end_va = 0x4233fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.2.db"
filename = "\\ProgramData\\Microsoft\\Windows\\Caches\\cversions.2.db" (normalized: "c:\\programdata\\microsoft\\windows\\caches\\cversions.2.db")
Region:
id = 3135
start_va = 0x4240000
end_va = 0x4241fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004240000"
filename = ""
Region:
id = 3136
start_va = 0x8580000
end_va = 0x85a3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008580000"
filename = ""
Region:
id = 3137
start_va = 0x4250000
end_va = 0x4258fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004250000"
filename = ""
Region:
id = 3138
start_va = 0x4260000
end_va = 0x4268fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004260000"
filename = ""
Region:
id = 3139
start_va = 0x85b0000
end_va = 0x85d3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000085b0000"
filename = ""
Region:
id = 3140
start_va = 0x85e0000
end_va = 0x85e0fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000085e0000"
filename = ""
Region:
id = 3141
start_va = 0x85f0000
end_va = 0x86effff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000085f0000"
filename = ""
Region:
id = 3142
start_va = 0x7ffd64800000
end_va = 0x7ffd6484cfff
monitored = 0
entry_point = 0x7ffd64817de0
region_type = mapped_file
name = "thumbcache.dll"
filename = "\\Windows\\System32\\thumbcache.dll" (normalized: "c:\\windows\\system32\\thumbcache.dll")
Region:
id = 3143
start_va = 0x86f0000
end_va = 0x86f1fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000086f0000"
filename = ""
Region:
id = 3144
start_va = 0x8700000
end_va = 0x8701fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000008700000"
filename = ""
Region:
id = 3145
start_va = 0x8710000
end_va = 0x8711fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "iconcache_idx.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db")
Region:
id = 3146
start_va = 0x8720000
end_va = 0x8720fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "iconcache_48.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db")
Region:
id = 3147
start_va = 0x8710000
end_va = 0x8711fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "iconcache_idx.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db")
Region:
id = 3148
start_va = 0x8720000
end_va = 0x8720fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "iconcache_48.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db")
Region:
id = 3149
start_va = 0x85b0000
end_va = 0x85b1fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "iconcache_idx.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db")
Region:
id = 3150
start_va = 0x8710000
end_va = 0x8757fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008710000"
filename = ""
Region:
id = 3151
start_va = 0x85c0000
end_va = 0x85c0fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "iconcache_48.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db")
Region:
id = 3152
start_va = 0x85c0000
end_va = 0x85c0fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "iconcache_48.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db")
Region:
id = 3153
start_va = 0x85c0000
end_va = 0x85c0fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "iconcache_48.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db")
Region:
id = 3154
start_va = 0x85c0000
end_va = 0x85c0fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "iconcache_48.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db")
Region:
id = 3155
start_va = 0x85b0000
end_va = 0x85b3fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000085b0000"
filename = ""
Region:
id = 3156
start_va = 0x8760000
end_va = 0x87a7fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008760000"
filename = ""
Region:
id = 3157
start_va = 0x87b0000
end_va = 0x882ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000087b0000"
filename = ""
Region:
id = 3158
start_va = 0x8830000
end_va = 0x88affff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008830000"
filename = ""
Region:
id = 3159
start_va = 0x85c0000
end_va = 0x85cffff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x00000000085c0000"
filename = ""
Region:
id = 3160
start_va = 0x4220000
end_va = 0x4225fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cachedimage_1440_900_pos4.jpg"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\CachedFiles\\CachedImage_1440_900_POS4.jpg" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\roaming\\microsoft\\windows\\themes\\cachedfiles\\cachedimage_1440_900_pos4.jpg")
Region:
id = 3161
start_va = 0x4900000
end_va = 0x4923fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004900000"
filename = ""
Region:
id = 3162
start_va = 0x4930000
end_va = 0x4953fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004930000"
filename = ""
Region:
id = 3163
start_va = 0x88b0000
end_va = 0x8da1fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000088b0000"
filename = ""
Region:
id = 3164
start_va = 0x8db0000
end_va = 0x8e2ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008db0000"
filename = ""
Region:
id = 3165
start_va = 0x7ffd637d0000
end_va = 0x7ffd63a6ffff
monitored = 0
entry_point = 0x7ffd637d51e0
region_type = mapped_file
name = "gameux.dll"
filename = "\\Windows\\System32\\gameux.dll" (normalized: "c:\\windows\\system32\\gameux.dll")
Region:
id = 3166
start_va = 0x4220000
end_va = 0x4221fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "thumbcache_idx.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")
Region:
id = 3167
start_va = 0x4960000
end_va = 0x4a5ffff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "thumbcache_48.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_48.db")
Region:
id = 3168
start_va = 0x48f0000
end_va = 0x48f0fff
monitored = 0
entry_point = 0x0
region_type = mapped_file
name = "netmsg.dll"
filename = "\\Windows\\System32\\netmsg.dll" (normalized: "c:\\windows\\system32\\netmsg.dll")
Region:
id = 3169
start_va = 0x4930000
end_va = 0x4931fff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000004930000"
filename = ""
Region:
id = 3170
start_va = 0x7ffd634b0000
end_va = 0x7ffd63658fff
monitored = 0
entry_point = 0x7ffd63504060
region_type = mapped_file
name = "gdiplus.dll"
filename = "\\Windows\\WinSxS\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\GdiPlus.dll" (normalized: "c:\\windows\\winsxs\\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.10586.0_none_0bdd1d3064f6384a\\gdiplus.dll")
Region:
id = 3171
start_va = 0x8e30000
end_va = 0x8eaffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000008e30000"
filename = ""
Region:
id = 3172
start_va = 0x8eb0000
end_va = 0x98affff
monitored = 1
entry_point = 0x0
region_type = pagefile_backed
name = "pagefile_0x0000000008eb0000"
filename = ""
Region:
id = 3173
start_va = 0x4a60000
end_va = 0x4a83fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004a60000"
filename = ""
Region:
id = 3174
start_va = 0x4940000
end_va = 0x4943fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.1.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")
Region:
id = 3175
start_va = 0x4950000
end_va = 0x4953fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "cversions.1.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")
Region:
id = 3176
start_va = 0x4a90000
end_va = 0x4aa8fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000010.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000010.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000010.db")
Region:
id = 3177
start_va = 0x4ab0000
end_va = 0x4ab1fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "iconcache_idx.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_idx.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_idx.db")
Region:
id = 3178
start_va = 0x4ac0000
end_va = 0x4ac0fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "iconcache_48.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Explorer\\iconcache_48.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\explorer\\iconcache_48.db")
Region:
id = 3179
start_va = 0x7ffd63120000
end_va = 0x7ffd634a1fff
monitored = 0
entry_point = 0x7ffd63171220
region_type = mapped_file
name = "iertutil.dll"
filename = "\\Windows\\System32\\iertutil.dll" (normalized: "c:\\windows\\system32\\iertutil.dll")
Region:
id = 3180
start_va = 0x4900000
end_va = 0x4925fff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x0000000004900000"
filename = ""
Region:
id = 3181
start_va = 0x98b0000
end_va = 0x992ffff
monitored = 1
entry_point = 0x0
region_type = private
name = "private_0x00000000098b0000"
filename = ""
Region:
id = 3182
start_va = 0x7ffd62f90000
end_va = 0x7ffd6311efff
monitored = 0
entry_point = 0x7ffd62fa01d8
region_type = mapped_file
name = "filesyncshell64.dll"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_4\\amd64\\FileSyncShell64.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_4\\amd64\\filesyncshell64.dll")
Region:
id = 3183
start_va = 0x4940000
end_va = 0x4958fff
monitored = 1
entry_point = 0x0
region_type = mapped_file
name = "{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000010.db"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\Windows\\Caches\\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.1.ver0x0000000000000010.db" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\windows\\caches\\{3da71d5a-20cc-432f-a115-dfe92379e91f}.1.ver0x0000000000000010.db")
Region:
id = 3186
start_va = 0x7ffd62e70000
end_va = 0x7ffd62f15fff
monitored = 0
entry_point = 0x7ffd62ebefec
region_type = mapped_file
name = "msvcp120.dll"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_4\\amd64\\msvcp120.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_4\\amd64\\msvcp120.dll")
Region:
id = 3187
start_va = 0x7ffd62af0000
end_va = 0x7ffd62d7dfff
monitored = 0
entry_point = 0x7ffd62bc0f00
region_type = mapped_file
name = "wininet.dll"
filename = "\\Windows\\System32\\wininet.dll" (normalized: "c:\\windows\\system32\\wininet.dll")
Region:
id = 3188
start_va = 0x7ffd62d80000
end_va = 0x7ffd62e6efff
monitored = 0
entry_point = 0x7ffd62da29cc
region_type = mapped_file
name = "msvcr120.dll"
filename = "\\Users\\RDhJ0CNFevzX\\AppData\\Local\\Microsoft\\OneDrive\\17.3.5892.0626_4\\amd64\\msvcr120.dll" (normalized: "c:\\users\\rdhj0cnfevzx\\appdata\\local\\microsoft\\onedrive\\17.3.5892.0626_4\\amd64\\msvcr120.dll")
Region:
id = 3189
start_va = 0x7ffd65110000
end_va = 0x7ffd65119fff
monitored = 0
entry_point = 0x7ffd65111350
region_type = mapped_file
name = "version.dll"
filename = "\\Windows\\System32\\version.dll" (normalized: "c:\\windows\\system32\\version.dll")
Thread:
id = 240
os_tid = 0x718
Thread:
id = 241
os_tid = 0x714
Thread:
id = 242
os_tid = 0x710
Thread:
id = 243
os_tid = 0x704
Thread:
id = 244
os_tid = 0x700
Thread:
id = 245
os_tid = 0x6fc
Thread:
id = 246
os_tid = 0x6ec
Thread:
id = 247
os_tid = 0x6dc
Thread:
id = 248
os_tid = 0x6e0
Thread:
id = 249
os_tid = 0x6d8
Thread:
id = 250
os_tid = 0x6cc
Thread:
id = 251
os_tid = 0x6b4
Thread:
id = 252
os_tid = 0x6b0
Thread:
id = 253
os_tid = 0x6ac
Thread:
id = 254
os_tid = 0x6a8
Thread:
id = 255
os_tid = 0x690
Thread:
id = 256
os_tid = 0x68c
Thread:
id = 258
os_tid = 0x720
Thread:
id = 259
os_tid = 0x724
Thread:
id = 260
os_tid = 0x730
Thread:
id = 261
os_tid = 0x73c
Thread:
id = 262
os_tid = 0x748
Thread:
id = 264
os_tid = 0x74c
Thread:
id = 265
os_tid = 0x754
Thread:
id = 266
os_tid = 0x758
Thread:
id = 267
os_tid = 0x75c
Thread:
id = 268
os_tid = 0x760
Thread:
id = 269
os_tid = 0x764
Thread:
id = 270
os_tid = 0x768
Thread:
id = 272
os_tid = 0x778
Thread:
id = 273
os_tid = 0x784
Thread:
id = 274
os_tid = 0x788
Thread:
id = 275
os_tid = 0x78c
Thread:
id = 276
os_tid = 0x790
Thread:
id = 279
os_tid = 0x794
Thread:
id = 280
os_tid = 0x798
Thread:
id = 281
os_tid = 0x7a4
Thread:
id = 282
os_tid = 0x7a8
Thread:
id = 283
os_tid = 0x7ac
Thread:
id = 284
os_tid = 0x7b0
Thread:
id = 285
os_tid = 0x7b4